The “Bug” that is on 80% of WordPress sites but that pay only 1/2 times

I am going to talk about a common wordpress "bug" that happens really often, it's an information disclosure via REST API.

For those who doesn't know REST API is a functionality of WP (WP=WordPress) that stores informations about posts, users, etc… and it's used to monitor/configure the site when you have some privileges. It's starts by /wp-json/

The probably most interesting route is /wp-json/wp/v2/users. That can leak usernames (with sometimes real names), some times e-mails, and other informations depending on configuration and plugins.

It's a low-medium impact but sometimes it can be escalated. For exemple, you can use that username for bruteforce of the wp-admin login (searching for weak credentials) or use a leaked email for OSINT/CSINT investigations because some programs accepts leaks (if you know that the email have some leaked passwords you can try them on the WP login).

But before reporting you need to verify 2 things :

Does it leaks enough informations ? if it's just 1 username like "admin" don't report. But if it leaks 4 usernames containing real names with additional informations you can try to report depending on the scope.
Can you escalate it ? If you can escalate like in the previous ways we talked about it's more that low-medium, it's high if editor/author and critical if administrator (because you can RCE).

Here was the last time I reported it :

So when you feel it , try !

Thanks for reading.

Don't hesitate to contact me :

Mail : sadinfinite@outlook.com
Discord : sadinfinite