1

With the current WordPress API you can get a list of usernames and email addresses of all users in the system with almost no effort:

<url>/wp-json/wp/v2/users

Outputs something like:

[{  
  "id":1,
  "name":"admin",
  "url":"",
  "description":"",
  "link":"http:\/\/...\/author\/admin\/",
  "slug":"admin",
  "avatar_urls":{  
     "24":"http:\/\/1.gravatar.com\/avatar\/...",
     "48":"http:\/\/1.gravatar.com\/avatar\/...",
     "96":"http:\/\/1.gravatar.com\/avatar\/..."
  },
  "meta":[  

  ],
  "_links":{  
     "self":[  
        {  
           "href":"http:\/\/.../wp-json\/wp\/v2\/users\/1"
        }
     ],
     "collection":[  
        {  
           "href":"http:\/\/..."
        }
     ]
  }
  },...

The username and ID are immediately visible. I don't see how this is anything other than a clear user enumeration vulnerability.

  • 1
    Your output doesn't indicate that email addresses are leaked. Can you elaborate on that part? – Arminius Feb 10 '17 at 1:24
4

It's difficult to reliably prevent the enumeration of Wordpress users as there are multiple different ways they can be leaked. Besides the REST API approach, an attacker can also loop through author IDs to discover accounts or simply collect the authors of all published posts. Wordpress usernames simply weren't designed to be kept secret.

The biggest risk through username enumeration is that it reveals old guest or test accounts with weak passwords. As a Wordpress administrator I'd enforce strong passwords for all accounts, deactivate legacy accounts and wouldn't worry about the enumeration problem as there are much bigger threats to Wordpress installations (such as poorly written plugins).

Yet, if leaking usernames makes you feel uncomfortable, there are plugins like Stop User Enumeration that also take care of the REST API leak you described.

Also see: Can I Prevent Enumeration of Usernames?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.