WordPress Vulnerabilities

WordPress 4.7 - User Information Disclosure via REST API

Proof of Concept

http://www.example.com/wp-json/wp/v2/users

Affects WordPress

4.7
Fixed in WordPress 4.7.1

References

CVE
CVE-2017-5487
URL
https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/
URL
https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60
URL
https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
ec8c295f-0ab4-4ab9-9a3a-38e9d64e12d3

Timeline

Publicly Published
2017-01-11 (about 7 years ago)
Added
2017-01-12 (about 7 years ago)
Last Updated
2020-09-22 (about 3 years ago)

Other

Published
Title
Published
2015-02-22
Title
WP Ultimate CSV Importer <= 3.6.74 - Database Table Export
Published
2023-07-27
Title
Change WP Admin < 1.1.4 - Secret Login Page Disclosure
Published
2015-02-26
Title
EasyCart 1.1.30 - 3.0.20 - Privilege Escalation
Published
2022-07-12
Title
WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass
Published
2022-08-29
Title
Site Offline < 1.5.3 - Access Bypass