WordPress exposes the unauthenticated /wp-json/wp/v2/users endpoint by default — enabling Oracle-style enumeration attacks that harvest administrator usernames and feed credential-stuffing pipelines against wp-login.php.
The Unauthenticated REST API Catastrophe
Visual page builders destroy Core Web Vitals through DOM depth and synchronous JavaScript. A more severe vulnerability lives in the application layer: the native WP-JSON REST API. The /wp-json/wp/v2/users endpoint permits unauthenticated connections to extract the platform's user entity graph — administrator usernames, user IDs, and exposed email addresses (CVE-2023-5561).
The Toxic Brute-Force Pipeline
Attackers employ Oracle-style enumeration, sending iterative queries against the unthrottled API to map the entire user database. Harvested administrator identities feed automated brute-force scripts targeting wp-login.php. Verified high-privilege account names scale compromise probability exponentially versus dictionary attacks.
Mitigating API Leaks at the Filter Layer
Security-by-obfuscation and basic plugin firewalls are insufficient. Exposed routing nodes must be surgically removed at the PHP application layer using the rest_endpoints filter.
add_filter('rest_endpoints', function( $endpoints ) {
if ( isset( $endpoints['/wp/v2/users'] ) ) {
unset( $endpoints['/wp/v2/users'] );
}
if ( isset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] ) ) {
unset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] );
}
return $endpoints;
});To lock down REST topology entirely, intercept incoming requests, evaluate is_user_logged_in(), and throw HTTP 401 for external requests lacking session tokens.
add_filter( 'rest_authentication_errors', function( $result ) {
if ( ! empty( $result ) ) {
return $result;
}
if ( ! is_user_logged_in() ) {
return new WP_Error(
'rest_not_logged_in',
'Unauthorized REST access.',
array( 'status' => 401 )
);
}
return $result;
});Eradicating Cross-Origin Resource Misconfigurations
CORS misconfigurations compound API vulnerability. Broadcasting Access-Control-Allow-Credentials: true without strict domain whitelisting permits malicious third-party scripts to execute privileged actions. Supplement application-level PHP blocks with Nginx directives returning HTTP 404 for unauthorized REST attempts and WAF rules dropping rapid iterative requests against JSON pathways.
Immediate Action Required
Your infrastructure may be actively leaking user schemas. Run the Vicious Web Auditor to detect unauthenticated wp-json exposures and identify fatal API vulnerabilities before full brute-force compromise.