Wordpress Users Disclosure (/wp-json/wp/v2/users/)
Medium
T
Top Echelon Software
Submitted None
Actions:
Reported by
hammodmt
Vulnerability Details
Technical details and impact analysis
Hello Team @top_echelon_software
Information:
Using REST API, we can see all the WordPress users/author with some of their information.
Step To Reproduce:
You can get user info by entering below url in your browser:
https://www.topechelon.com/wp-json/wp/v2/users/
███████
## Impact
Authors : LTR , LTREditor can be created scenario of doing bruteforce attacks to this users
Malicious counterpart could collect the usernames disclosed (and the admin user) and be focused throughout BF attack (as the usernames are now known)
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Information Disclosure