WordPress REST API leaks valid usernames to anyone

WordPress sites include a built-in REST API endpoint, /wp-json/wp/v2/users, that can return a list of real account usernames on the site. This check only runs when WordPress is detected, and probes that endpoint directly. On this site, that endpoint returned valid account usernames to a request with no login required. Leaking valid usernames removes half the work involved in a credential-stuffing or brute-force attack, since an attacker no longer needs to guess or find a username, only a matching password. Combined with an open XML-RPC endpoint, a separate, related weak point, this becomes a fairly direct path toward an actual account takeover. Your developer should block unauthenticated access to the WordPress users REST endpoint, commonly done through a security plugin such as Wordfence or a small code snippet that restricts the endpoint to logged-in requests, and enable two-factor authentication (2FA) on all accounts as a second layer of defence even if a password is eventually guessed.