Exposed wp-config.php.bak backup file

What it is

A backup copy of wp-config.php (wp-config.php.bak) is publicly downloadable. This file normally contains your database name, username and password in plain text — anyone who finds it gets direct database access.

How to fix it

Delete this backup file from the server immediately (or move it outside the web root) — the WordPress Plugin's Security tab can block access to files like this automatically.