WordPress Vulnerabilities

WordPress 4.7 - User Information Disclosure via REST API

Proof of Concept

Affects WordPress

4.7
Fixed in WordPress 4.7.1

References

CVE
CVE-2017-5487
URL
https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/
URL
https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60
URL
https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
ec8c295f-0ab4-4ab9-9a3a-38e9d64e12d3

Timeline

Publicly Published
2017-01-11 (about 9 years ago)
Added
2017-01-12 (about 9 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2018-02-08
Title
Swape Theme - Authentication Bypass and Stored XSS
Published
2015-05-26
Title
Estrutura-Basica - Local File Download
Published
2019-05-29
Title
ConvertPlus <= 3.4.2 - Unauthenticated Arbitrary User Role Creation
Published
2020-03-04
Title
WooCommerce Smart Coupons < 4.6.5 - Unauthenticated Coupon Creation
Published
2016-05-06
Title
Yoast SEO <= 3.2.4 - Subscriber Settings Sensitive Data Exposure