Nextcloud · Report #625199

Wordpress Users Disclosure

Duplicatestatus

highseverity

8upvotes

1 Jul 2019disclosed

How it was found

Information Using REST API, we can see all the WordPress users/author with some of their information.

Step to Reproduce You can get user info by entering below url in your browser: https://nextcloud.com/wp-json/wp/v2/users

Reference: #356047

Authors : LTR , LTREditor can be created scenario of doing bruteforce attacks to this users.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original