Description
User Enumeration occurs when web applications inadvertently reveal whether a username exists on the system, either due to misconfiguration or design decisions. Attackers exploit this by gathering a list of valid usernames to launch targeted attacks, such as brute force or default username and password attacks.
Recommendation
Block HTTP requests to /?author= and /wp-json/wp/v2/users/ URLs. You can use functions.php or .htaccess for this. The below snippet is a sample .htaccess code you can use to prevent WordPress user enumeration.
RewriteEngine on
RewriteCond %{QUERY_STRING} (author=\d+) [OR]
RewriteCond %{REQUEST_URI} /wp-json/wp/v2/users/
RewriteRule .* - [F]
You should also make sure your theme is not displaying usernames.
Another option is to use plugins available for blocking user enumerations.
References
Could your website be exposed too?
SmartScanner can check your website for WordPress User Enumeration and gives you actionable findings to investigate.
Start a free scanRelated Issues
- User Enumeration - Vulnerability
- WordPress Login Page Found - Vulnerability
- Unreferenced Login Page Found - Vulnerability
- Microsoft IIS Tilde Directory Enumeration - Vulnerability
