Fix user disclosure on REST API in WordPress
Walkthrough Overview
About This Video Guide
Have you had a Pen test and found user information is disclosed on the REST API?
In this video I show you how we can fix this issue for your WordPress setup.
We have two methods,
The GIST code snippet methods found here: https://gist.github.com/mrkdevelopment/0858637df62b43e5ffb3490d33e3768b
A full plugin method here: https://github.com/MRKWP/mrkwp-rest-permissions/
This exploit was documented as https://www.cvedetails.com/cve/CVE-2017-5487/
It is currently considered fixed inside WordPress 4.7 or greater. Depending on your Audit, you will see the disclosure issue in your security audit all the way up to WordPress 6.5 or greater.
The user api is still readable, it just has much less information in it that originally set up in the REST API.
The solution in this video is to 401 / 403 the end point for REST API when you are not logged in with an Administrative level (Post Editing) level in the WordPress website.
You can visit my blog for more on WordPress security: https://www.mrkwp.com/tag/wordpress-security/
Core Focus Areas
- 1Practical, production-tested techniques tailored for WordPress and modern tooling.
- 2Stripping away fragile dependencies so your site stays fast and resilient.
- 3Workflows structured so your internal team can maintain and own them long-term.
More Practical Walkthroughs
Explore step-by-step video tutorials and technical walkthroughs.
Let’s figure it out together
You don’t have to
build alone.
A little guidance. A good conversation. A better next step.
Start with a 20-minute call. I read every enquiry myself.