Should I be concerned about the WordPress REST API's user enumeration vulnerability?

Question

With the current WordPress API you can get a list of usernames and email addresses of all users in the system with almost no effort:

<url>/wp-json/wp/v2/users

Outputs something like:

[{  
  "id":1,
  "name":"admin",
  "url":"",
  "description":"",
  "link":"http:\/\/...\/author\/admin\/",
  "slug":"admin",
  "avatar_urls":{  
     "24":"http:\/\/1.gravatar.com\/avatar\/...",
     "48":"http:\/\/1.gravatar.com\/avatar\/...",
     "96":"http:\/\/1.gravatar.com\/avatar\/..."
  },
  "meta":[  

  ],
  "_links":{  
     "self":[  
        {  
           "href":"http:\/\/.../wp-json\/wp\/v2\/users\/1"
        }
     ],
     "collection":[  
        {  
           "href":"http:\/\/..."
        }
     ]
  }
  },...

The username and ID are immediately visible. I don't see how this is anything other than a clear user enumeration vulnerability.

Answer 1

It's difficult to reliably prevent the enumeration of Wordpress users as there are multiple different ways they can be leaked. Besides the REST API approach, an attacker can also loop through author IDs to discover accounts or simply collect the authors of all published posts. Wordpress usernames simply weren't designed to be kept secret.

The biggest risk through username enumeration is that it reveals old guest or test accounts with weak passwords. As a Wordpress administrator I'd enforce strong passwords for all accounts, deactivate legacy accounts and wouldn't worry about the enumeration problem as there are much bigger threats to Wordpress installations (such as poorly written plugins).

Yet, if leaking usernames makes you feel uncomfortable, there are plugins like Stop User Enumeration that also take care of the REST API leak you described.

Also see: Can I Prevent Enumeration of Usernames?