Directory listing on uploads
Effort to fix: Quick win (under an hour)
Why it matters
Anyone can browse every file you've ever uploaded, including drafts, exports and private documents.
How to fix it
Disable directory indexes on the web server.
On WordPress
Add Options -Indexes to .htaccess (Apache) or autoindex off; (Nginx); an empty index.php in the folder also works.