This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A critical flaw in WordPress REST API (`class-wp-rest-users-controller.php`). π₯ **Consequences**: Remote attackers can extract sensitive user information via simple HTTP requests to `/wp-json/wp/v2/users`.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: Improper access control in the REST API implementation. π **Flaw**: The endpoint exposes user data without sufficient authentication checks, allowing unauthorized enumeration.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: WordPress installations running versions **< 4.7.1**. π **Date**: Published Jan 15, 2017. π§ **Component**: `wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php`.
Q4What can hackers do? (Privileges/Data)
π΅οΈ **Hackers Can**: Enumerate valid usernames. π **Data Leaked**: User lists and potentially associated metadata. π **Privileges**: No admin access needed; remote, unauthenticated exploitation.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: **LOW**. π **Auth**: None required. βοΈ **Config**: Default REST API settings are sufficient for exploitation. Easy to trigger.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exp?**: **YES**. π οΈ **Tools**: Multiple PoCs exist (e.g., `wpUsersScan`, `krpexploit.py`). π **Wild Exp**: Active exploitation tools are available on GitHub and Exploit-DB.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Send a GET request to `http://<target>/wp-json/wp/v2/users`. π **Indicator**: If the response returns a JSON array of users, the site is vulnerable. π‘ **Scan**: Use automated scanners like `wpUsersScan.β¦
π§ **No Patch?**: Disable or restrict the REST API. π **Workaround**: Use plugins to block `/wp-json/wp/v2/users` access or remove user enumeration capabilities via code snippets. π **Limit**: Restrict API endpoints to auβ¦
π¨ **Urgency**: **HIGH**. β οΈ **Priority**: Immediate patching required. π **Risk**: User enumeration aids further attacks (brute force, social engineering). Do not ignore!