WordPress REST API User Enumeration Vulnerability Scanner

WordPress Core is an open-source website creation tool written in PHP, primarily used for creating blogs, content management systems, and e-commerce websites. It is one of the most popular content management systems, boasting an extensive community and a wide range of plugins and themes to customize websites. WordPress Core is known for its ease of use, flexibility, and scalability, making it a go-to choice for businesses of all sizes.

The User Enumeration vulnerability detected in WordPress REST API allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request. In simpler terms, anyone could view a list of post authors and sensitive user information, such as usernames and email addresses, via a REST API endpoint. This vulnerability was patched in the 4.7.1 update, but it still affects sites that have not been updated.

Exploiting this vulnerability could lead to serious consequences, such as unauthorized access to sensitive data, unauthorized user account creation, or a complete takeover of the website. Attackers could take advantage of this vulnerability by collecting information on users and using this information to launch further attacks.

Securityforeveryone.com is a powerful platform that provides detailed reports on vulnerabilities in digital assets, including websites hosted on WordPress. Using the pro features of this platform, users can easily and quickly learn about vulnerabilities, take necessary precautions, and ensure the security of their websites. The platform offers a comprehensive set of features, including monthly reports, security alerts, and remediation advice, making it a valuable tool for businesses of all sizes. Protect your digital assets and stay ahead of potential threats with securityforeveryone.com.

REFERENCES

• http://www.openwall.com/lists/oss-security/2017/01/14/6
• http://www.securityfocus.com/bid/95391
• http://www.securitytracker.com/id/1037591
• https://codex.wordpress.org/Version_4.7.1
• https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60
• https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/
• https://wpvulndb.com/vulnerabilities/8715
• https://www.exploit-db.com/exploits/41497/
• https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/