Security Test: WordPress REST API Users Exposed¶

Scanner(s) Support¶

Description¶

Default Severity: high

The issue occurs when the WordPress REST API exposes user details through an unauthenticated request to /wp/users. This can allow attackers to enumerate users, aiding in reconnaissance and potentially targeting specific individuals for attacks.

Configuration¶

Identifier: information_disclosure/wordpress_rest_api_users_exposed

Examples¶

All configuration available:

checks:
  information_disclosure/wordpress_rest_api_users_exposed:
    skip: false # default

Compliance and Standards¶