With the current WordPress API you can get a list of usernames and email addresses of all users in the system with almost no effort:


Outputs something like:



The username and ID are immediately visible. I don't see how this is anything other than a clear user enumeration vulnerability.

  • 1
    Your output doesn't indicate that email addresses are leaked. Can you elaborate on that part?
    – Arminius
    Commented Feb 10, 2017 at 1:24

1 Answer 1


It's difficult to reliably prevent the enumeration of Wordpress users as there are multiple different ways they can be leaked. Besides the REST API approach, an attacker can also loop through author IDs to discover accounts or simply collect the authors of all published posts. Wordpress usernames simply weren't designed to be kept secret.

The biggest risk through username enumeration is that it reveals old guest or test accounts with weak passwords. As a Wordpress administrator I'd enforce strong passwords for all accounts, deactivate legacy accounts and wouldn't worry about the enumeration problem as there are much bigger threats to Wordpress installations (such as poorly written plugins).

Yet, if leaking usernames makes you feel uncomfortable, there are plugins like Stop User Enumeration that also take care of the REST API leak you described.

Also see: Can I Prevent Enumeration of Usernames?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .