WordPress user enumeration via REST API

Scan.now sends GET /wp-json/wp/v2/users. A finding requires a 200 response containing a JSON array with slug fields, which are the users' user_nicename values and by default equal their login names. It also requests /?author=1 and treats a redirect to /author/<name>/ as a second enumeration route. The report shows how many accounts were listed and the first few slugs, so you can see whether they match real logins. A 401 response from the REST route, or an author query that returns 404 or the homepage, passes. Scan.now stops at enumeration: it never attempts a login. Rated medium, and higher in practice when xmlrpc.php is also enabled, because the two together make credential guessing efficient. This check runs only when WordPress is detected.

A password guess against an unknown username is two unknowns; against a known one it is a dictionary attack. WordPress's REST API lists every user who has published a post, and the author-archive redirect resolves numeric IDs to names, so an attacker collects the administrator's login name in one request and feeds it to xmlrpc.php or wp-login.php. The project considers usernames public by design (they appear on author pages) and does not treat this as a vulnerability, which is a reasonable position for a blog with strong passwords and two-factor authentication and a poor one for a site whose admin password is a pet's name. There is a privacy angle too: the list reveals staff and contributors, useful for social engineering. Reducing exposure costs nothing and removes the easiest reconnaissance step. The WordPress scanning guide places this in the hardening order.

Hide the user routes from anonymous requests while keeping them for logged-in editors (the block editor needs them):

add_filter('rest_endpoints', function ($endpoints) {
    if (!is_user_logged_in()) {
        unset($endpoints['/wp/v2/users'], $endpoints['/wp/v2/users/(?P<id>[\d]+)']);
    }
    return $endpoints;
});
// stop ?author=N resolving to /author/name/
add_action('template_redirect', function () {
    if (is_author() && isset($_GET['author'])) { wp_redirect(home_url(), 301); exit; }
});

nginx can refuse the numeric author query before it reaches PHP:

if ($args ~* "^author=\d+") { return 403; }

Apache (mod_rewrite, in .htaccess):

RewriteCond %{QUERY_STRING} ^author=\d+ [NC]
RewriteRule ^ - [F]

Cloudflare WAF custom rule: block /wp-json/wp/v2/users for requests without a wordpress_logged_in cookie. Set each user's public display name to something other than their login, and make the login itself defensible: long unique passwords, two-factor authentication, and a login limiter such as the one built into most security plugins.