WordPress REST API leaks valid usernames to anyone
WordPress sites include a built-in REST API endpoint, /wp-json/wp/v2/users, that can return a list of real account usernames on the site. This check only runs when WordPress is detected, and probes that endpoint directly. On this site, that endpoint returned valid account usernames to a request with no login required.
Why this matters
Leaking valid usernames removes half the work involved in a credential-stuffing or brute-force attack, since an attacker no longer needs to guess or find a username, only a matching password. Combined with an open XML-RPC endpoint, a separate, related weak point, this becomes a fairly direct path toward an actual account takeover.
How to fix it
Your developer should block unauthenticated access to the WordPress users REST endpoint, commonly done through a security plugin such as Wordfence or a small code snippet that restricts the endpoint to logged-in requests, and enable two-factor authentication (2FA) on all accounts as a second layer of defence even if a password is eventually guessed.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit