HexBrain

WordPress · Report #385322

Open API For Username enumeration

N/Astatus
lowseverity
25upvotes
23 Jul 2018disclosed

How it was found

We Can do username enumeration, Reproduce:

  1. Go any wordpress site. #2.www.site.com/?author=1 (type ?author=1 at end of site)
  2. You will get www.site.com/author/admin (now, admin is username of login panel of that site)

Thanks, Sameer Phad

Impact

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original