Default CMS Install Page Exposed
The CMS installer (install.php, setup wizard) is still reachable, letting anyone re-run it and take over the site.
What is Default CMS Install Page Exposed?
Installers are meant to run exactly once. When the setup wizard of WordPress, PrestaShop, Magento, Drupal, or a self-hosted panel remains reachable after installation, an attacker can try to re-run it. Depending on the software, a reachable installer can be re-executed if the configuration allows (some detect existing config and abort — some do not), leak database connection details in error output, or offer a fresh-admin backdoor on partially installed systems. The same finding class covers setup directories (like /install/), upgrade wizards, and diagnostic pages that were left in place "temporarily". Bots probe for these paths on every host because misconfigured installs are common and the payoff is complete control.
Why It Matters to Your Business
A reachable installer is a direct path to full site takeover: re-run installation pointed at an attacker-chosen database, create a fresh administrator, or extract configuration the installer prints when it fails. Real-world mass-exploitation campaigns have scanned specifically for exposed install and setup pages of popular shop and CMS software. The fix is deleting a few files and blocking a few paths — minutes of work versus a full incident response.
How to Fix It
1. Delete installer files after every setup or upgrade (re-check after updates — some packages recreate them):
WordPress: wp-admin/install.php (only needed for fresh installs — if the site is installed, deny it), wp-admin/setup-config.php
PrestaShop: /install/ directory — delete entirely
Magento: app/Magento/Setup subpath exposure — deny /setup on the web server
2. Block the paths at the web server so recreation does not re-expose them:
Nginx:
location ~ ^/(wp-admin/)?(install|setup-config)\.php { deny all; return 404; }
location ^~ /install/ { deny all; return 404; }
Apache:
<FilesMatch "^(install|setup-config)\.php$">
Require all denied
</FilesMatch>
3. Confirm the database is not reachable from outside (installer abuse usually requires pointing it somewhere) — bind MySQL to localhost, firewall 3306.
4. Verify no default accounts remain (admin/admin) and file-integrity monitoring alerts on new files in the web root.
Frequently Asked Questions
Why is an installer dangerous after the site is installed?
Because installers hold elevated power: they write configuration, create the first administrator, and connect to databases. Depending on the software and its checks, a reachable installer can be abused to reconfigure the application, create a backdoor admin, or leak connection details in errors.
Which files should I delete or block?
WordPress: wp-admin/install.php and wp-admin/setup-config.php. PrestaShop: the whole /install/ directory. Magento: the /setup endpoint. Also remove any leftover upgrade wizards and one-click-installer panels your host provided.
How do I verify the installer is gone?
Request the installer URL directly — it must return 404 or 403. Or run a free scan on this page: the installer-exposure and default-credential scanners check these paths and dozens of related setup surfaces.
Technical Classification
| OWASP Category | A05:2021 — Security Misconfiguration |
| CWE ID | CWE-16: Configuration Weakness |
| Detected By | cms_installer_exposure, default_credentials scanner(s) |
| Severity Level | high |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our cms_installer_exposure, default_credentials scanner checks for this issue automatically.
Scan My Website FreeRelated Vulnerabilities
Outdated CMS Version
The CMS (WordPress, Joomla, Drupal) is running an outdated version with known security vulnerabilities.
Vulnerable JavaScript Library
The site uses an outdated JavaScript library (jQuery, Lodash, Bootstrap, Angular) with known vulnerabilities.
WordPress XML-RPC Interface Enabled
xmlrpc.php is enabled, giving bots a brute-force amplifier (system.multicall) and a pingback abuse surface.
WordPress readme.html File Exposed
The default readme.html discloses your exact WordPress version, handing attackers a targeted exploit list.