Just to follow up on myself, I installed skipfish and ran it against my site in the easiest mode (./skipfish -W /dev/null -LV -o rpt http://example.com http://e

Just to follow up on myself, I installed skipfish and ran it against my site in the easiest mode (./skipfish -W /dev/null -LV -o rpt http://example.com http://example.com) * I got the same two errors and they were completely benign. The directory traversal problem was just Wordpress returning some data. The "interesting file" was a blog post that had some SQL in it. I'm not sure if they're the same that you found. But if I would have paid for the scan and they turned out to be the same two errors, I would have been pretty angry. * Skipfish came back with some actual interesting things like embedded scripts and forms without xsrf protection. The embedded scripts were ok (ad/tracking codes), but the forms would have been an interesting thing to note.