Oct 22, 2026, 9:38 PM@amy @mhoye
check /wp-json/wp/v2/users/1
vary the last number to scan thru the users.
my "note to self" email about this is from 2018 and my test "canary" for this only stopped responding in the last 12mo (tho maybe they upgraded their security, idk and havent bothered to check any other sites).
it's trivial to disable access but shocking that it isnt by default.
Oct 22, 2026, 9:43 PM@nflux@gts.exile.social @mhoye@cosocial.ca doesn't seem to work on a random wordpress demo thing i found, it lists 1 of the users (the initial one) but returns an error for other users. not convinced this is fully patched on a vanilla instance. let me pull from docker and see
Oct 22, 2026, 10:17 PMOct 22, 2026, 10:21 PM@amy @mhoye you can do a similar trick on the author pages of the site to match userids to usernames (link to author usually on each blog post, if that isnt disabled).
i kept noticing that attackers were trying real usernames but our display names were always deliberately different and I was confused as to where they were getting them from so again went on a bit of a dig about this and built a few poc tools to try and recreate their results (so that I could then block them to infinity)
Oct 22, 2026, 10:23 PM@amy @mhoye *also the initial one is usually an admin, at which point they're one badly configured spf record (and/or missing dmarc) away from getting spoofed+phished, and both of those records are, again, public. you dont generally have to look very far to find a site with shoddy spf/dmarc either., though big mail providers recently *requiring* dmarc to be configured actually helped quite a lot there.
Oct 22, 2026, 10:38 PM@amy @mhoye also the venn diagram of PBN sites on expired+revived domains and badly configured wp sites is basically a circle.
*for everyone else: pbn sites are "personal blog network" sites which is an seo trick where you find an expired site like davestyreshop.com who were popular & well ranked but then dave retired/died/went bust & his domain expired but all the backlinks he accrued over his 20 years in business still exist. you use yandex & some other tools i forget the name of to find domains like that in the first place & also all the existing backlinks and then set up a new site with pages to match those old backlinks so they dont 404. you then scatter links thru that site to yourtyreshop.com (which you're actually trying to promote) & reap the benefit of Dave's 20 years of link building. repeat 3-5x for plenty of organic traffic (albeit relatively low quality, & imho it's better to just write good original content rather than resort to shitty tricks)
Oct 22, 2026, 11:03 PMOct 22, 2026, 11:07 PMOct 23, 2026, 12:32 AMOct 23, 2026, 12:36 AMOct 22, 2026, 11:34 PM@nflux@gts.exile.social @mhoye@cosocial.ca so i did a little bit of hackering. i've got a way to enumerate users based on their ID (which leaks not much more than you get publicly, if anything), though it does allow for easy automation. looks like they have patched some of those holes.
Oct 22, 2026, 11:37 PM@nflux@gts.exile.social @mhoye@cosocial.ca https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L504-L510 this is what stops you enumerating it normally, ie what i ran into on the demo instance
and this is what's stopping me from enumerating all the juicy fields from a user. you need "edit" permission to do that
https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-controller.php#L588-L596
i will possibly have another look tomorrow because this code does seem overly complex and potentially prone to error. i already found a way to request specific users through the api (with the only pre-req being that they've ever written a post, with my current findings)
Oct 23, 2026, 12:02 AM@nflux@gts.exile.social @mhoye@cosocial.ca i should go the fuck to sleep. not like i would be inclined to contribute patches to wp anyways, fun little nerd snipe though. there's probably something to this if someone really wants to
Oct 23, 2026, 12:12 AM@amy @mhoye well it's good that they've somewhat patched some of these things. the dismissive attitude i got when i reported it put me off pursuing it further, and to some extent my sites' survival depended on not being the easiest pickings, and their policy helped with that.
i guess if they patched it (eventually) perhaps my report *was* actually valid then hmm, whaddya know 🤔
am i allowed to be a bit smug about that, as a treat?
Oct 23, 2026, 12:19 AM@nflux@gts.exile.social @mhoye@cosocial.ca what's really interesting is i cannot see the patch in which they added these checks. the context flag "edit" has always existed since the feature was added
wonder if you had also some kind of auth bypass going on at the time lollll
https://github.com/WordPress/WordPress/blob/e4a7c0a397b07764999aae94f4bf1567ebf4a9d1/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L826
Oct 23, 2026, 12:45 AM@amy @mhoye i have no idea. i tested it on random sites periodically to which i had no access and it nearly always worked, both as a way of establishing "do these ppl im considering dealing with have their shit together" and also as a potential freebie to offer them by way of getting freelance work in a "did you realise all your stuff was exposed"-sorta way 🤷🏼♀️ (almost always no and no).