Vulnerability Highlight: Username Enumeration Part 1

By default, the CMS functionality exposes sensitive information to an external threat actor that they are not explicitly authorised to access. The REST API does not properly restrict the listings of post authors, which allows remote attackers to obtain sensitive information via a ‘/wp-json/wp/v2/users’ request.

There are lots of different tools that will automatically enumerate application usernames for you, such as ‘wpscan’ or ‘nuclei’. However, you cannot beat a simple linux command line request:

curl https://domain.com/wp-json/wp/v2/users | jq . | grep name

curl https://domain.com/?rest_route=/wp/v2/users | jq . | grep name

‍

‍

If not whitelisted, these enumerated usernames can then form the basis for a targeted password attack against the ‘/wp-admin.php’ login portal. In some instances, against the endpoint itself. Should these accounts be compromised, the attacker could use the access to make malicious changes and deface the website. Additionally, if a high-privileged account is compromised, then access could be used to introduce malicious code affecting all users of the application.

Remediation and Preventative Action:

The 'stop user enumeration' option should be checked in the WordPress security configuration. It is also possible to prevent the attack via the WordPress ‘functions.php’ file and via ‘.htaccess’ files.

To block user-enumeration via ‘functions.php’, add the following code snippet to your applications functions file:

‍

‍

If you would rather block requests at the server level, you can add the following code snippet to your sites root ‘.htaccess’ file:

‍

‍

Further Information - https://wordpress.org/plugins/stop-user-enumeration

Information regarding WordPress vulnerabilities and remediation measures may become outdated over time as new security threats emerge and security updates are released. It is important to stay informed and regularly update your WordPress installation and security configurations to stay protected against potential threats.

‍

‍