WordPress REST API User Enumeration: Preventing Username Harvesting

By default, the WordPress REST API exposes the full list of registered site authors and administrators at /wp-json/wp/v2/users.

Adversaries harvest legitimate administrator usernames, allowing automated botnets to focus exclusively on password brute-forcing.

Vulnerability Risk & Threat Impact

Exposing administrator usernames halves the effort required for brute-force and credential stuffing campaigns.

How Our Scanner Inspects for This Flaw

Site Check queries /wp-json/wp/v2/users to verify whether account names are exposed to unauthenticated visitors.

Auditing WordPress environments inspects default operational endpoints (/wp-json/, /xmlrpc.php, /wp-content/plugins/) to identify user enumeration vectors, debugging logs, and vulnerable plugin footprints without generating database query strain.

Remediation Guide (Step-by-Step Fix)

To resolve this vulnerability, apply the following configuration or code snippet to your web server:

      // Add to functions.php in your WordPress theme:
add_filter('rest_endpoints', function($endpoints) {
    if (!is_user_logged_in() && isset($endpoints['/wp/v2/users'])) {
        unset($endpoints['/wp/v2/users']);
    }
    return $endpoints;
});
    

• Disable public access to the /wp/v2/users REST endpoint for unauthenticated visitors.
• Never use 'admin' as an administrative username.

Attack Anatomy & Real-World Business Impact

The default WordPress /wp-json/wp/v2/users endpoint reveals valid administrator and author usernames, furnishing automated attackers with credential brute-force targets.

Compliance Framework Impact: Failure to enforce user enumeration protections specified in OWASP Top 10 (A01:2021 Broken Access Control) and NIST 800-63B guidelines.

CLI Remediation Verification: Terminal Commands

After applying configuration changes or patching source code, verify that the exposure is neutralized using command-line diagnostic tools:

curl -s https://your-domain.com/wp-json/wp/v2/users | grep "slug"
# Must require authentication or return 404
    

DevSecOps Best Practices & CI/CD Hardening

Disable public user enumeration via the rest_authentication_errors filter hook or comprehensive security plugins.