CVE-2017-5487
- State
- Published
- Severity
- Not scored
- Published
- Jan 15, 2017
- Updated
- Aug 5, 2024
- Reserved
- Jan 14, 2017
Description
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 41497exploit
- https://wpvulndb.com/vulnerabilities/8715
- https://codex.wordpress.org/Version_4.7.1
- https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60
- [oss-security] 20170114 Re: CVE Request: Wordpress: 8 security issues in 4.7mailing-list
- https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/
- 1037591vdb-entry
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/
- 95391vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.