Security Test: WordPress oEmbed Endpoint Exposure¶

Scanner(s) Support¶

Description¶

Default Severity: high

The issue arises when WordPress exposes its oEmbed endpoint at /oembed/1.0/embed, which allows unauthenticated users to request embedded content. This could potentially lead to information leakage, allowing attackers to enumerate posts or extract metadata about the site. It's essential to either restrict access to this endpoint or disable it entirely if it's not required for the site.

Configuration¶

Identifier: information_disclosure/wordpress_oembed_endpoint_exposed

Examples¶

All configuration available:

checks:
  information_disclosure/wordpress_oembed_endpoint_exposed:
    skip: false # default

Compliance and Standards¶