CVE-2017-5487: WordPress REST API user endpoint exposes author usernames

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is trivially exploitable without authentication, has a very high EPSS score and public exploit code, and directly enables credential attacks, though it only leaks information rather than executing code.

What it is

WordPress 4.7 before 4.7.1 fails to properly restrict listings of post authors in the REST API users controller. An unauthenticated request to wp-json/wp/v2/users returns author data, exposing usernames and other sensitive information. This matters because harvested usernames feed credential-stuffing and brute-force attacks against WordPress logins.

Impact

An attacker gains a list of valid WordPress usernames and associated author metadata without authentication. That information enables targeted password guessing and account enumeration against the site.

Attack surface

Reached remotely over HTTP via a GET request to wp-json/wp/v2/users; the CVSS vector shows no privileges required and no user interaction. Any internet-facing WordPress 4.7 instance with the REST API enabled is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.87299 (99.7th percentile) and a public Exploit-DB entry (41497) exists, indicating active and easy exploitation. No ransomware group usage is documented.

What to do

• Upgrade WordPress to 4.7.1 or later, which contains the fix in the REST API users controller.
• If immediate upgrade is not possible, disable or restrict the unauthenticated REST API users endpoint via a plugin or web server rule.
• Block or rate-limit requests to /wp-json/wp/v2/users at the WAF or reverse proxy.
• Enforce strong unique passwords and multi-factor authentication to blunt username-based credential attacks.
• Audit logs for enumeration attempts and monitor for follow-on brute-force activity.

Detection

• Search web access logs for GET requests to /wp-json/wp/v2/users and /?rest_route=/wp/v2/users.
• Alert on high-volume or automated requests to the users endpoint from single source IPs.
• Correlate user endpoint enumeration with subsequent failed login attempts for the harvested usernames.
• Check WordPress version inventory for any instance still on 4.7 before 4.7.1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.