Yelp: Able to download arbitrary PHP files at yelpblog.com

There is a misconfigured wordpress installation at yelpblog.com, through which i am able to download any php files in wp-includes folder. For a PoC, you can open https://www.yelpblog.com/wp-includes/wp-db.php, and the wp-db.php will be downloadalong with all the data in it As we all know that the...