Can you explain this vulnerability to me?

The vulnerability in the Stop User Enumeration WordPress plugin before version 1.7.3 allows an attacker to bypass the plugin's protection by URL-encoding the REST API path /wp-json/wp/v2/users/. This means that although the plugin blocks user enumeration requests for non-authorized users, an attacker can still access user information by encoding the URL, effectively circumventing the intended access restrictions.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can allow unauthorized users to enumerate WordPress users via the REST API, potentially exposing usernames and other user-related information. This can facilitate further attacks such as brute force login attempts, social engineering, or privilege escalation.

Useful 0 Not Useful 0