HexBrain

Ian Dunn · Report #151583

User enumeration in wp-admin

N/Astatus
2upvotes
16 Jul 2016disclosed

How it was found

Hi, I have found that in the page wp-admin possible to perform user enumeration though differences in error massages: if user exist the site will return :" ERROR: The password you entered for the username admin is incorrect." if user not exit: Invalid username.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original