The WPScan security scanner may be regarded a Swiss army knife of WordPress security. Aside from using WPScan to detect vulnerable plugins, themes and WordPress core installations, WPScan can also be used for an attack known as user enumeration.
What is WordPress user enumeration?
In a user enumeration attack, an attacker looks for subtle differences in how WordPress responds to specific requests. Depending on the response, the attacker can determine whether a user exists or not.
While at first glance this may seem harmless, keep in mind that an attacker may be able to use this information as part of a larger attack.
By default, WordPress is vulnerable to user enumeration, which means that you would likely need to make some small changes in your web server configuration to protect against such attacks. This is where WPScan’s user enumeration tool comes in — it helps you quickly identify if a WordPress installation is vulnerable to user enumeration.
By running the following command, WPScan will attempt to enumerate all users on a given WordPress installation. If successful, it will display a result similar to the below screenshot.
wpscan –url http://example.com –enumerate u
Why does user enumeration work on WordPress?
WordPress user enumeration works on every WordPress site by default because of a WordPress feature called permalinks. Permalinks are permanent URLs to individual WordPress posts and pages — (e.g. http://example.com/?p=123).
In addition to posts and pages, WordPress also allows you to list all posts by a particular author’s username (e.g. http://example.com/author/andy). However, crucially, WordPress also allows you to refer to authors using their ID (e.g. http://example.com/?author=2), and then redirects you to the previously mentioned URL containing the username. It is possible for attackers to abuse this functionality to figure out which usernames are valid for a particular WordPress site.
To make matters worse, the above method also works for users who are not actually authors of posts or pages. Notice that even though the below screenshot shows an error, WordPress still returns the username in question.
Incidentally, there are also other ways for attackers to obtain a list of WordPress users, of which WPScan supports several. One such example is to use the REST APIs within WordPress which is enabled by default.
What happens if an attacker knows the usernames of your WordPress users?
There are no direct impact problems that are derived from an attacker knowing the usernames on your WordPress website. However, every targeted hack attack starts with information gathering. During this process attackers try to gather as much information as they can about the target website. They look for information such as usernames, names of installed plugins, themes, their versions and several other factors.
Attackers then use all the gathered information to try to find ways how to attack the target website. Therefore even though an attacker cannot exactly hack your website by knowing the usernames, the more information you can hide from them, the better it is.
How do I prevent user enumeration on my WordPress site?
WordPress leaks usernames in several ways. In truth there is no way to fully prevent user enumeration, particularly if your website makes use of authors pages. However, you can certainly reduce the attack surface and make user enumeration harder by following the below steps:
- Disable the WordPress REST API if you are not using it,
- Disable WordPress XML-RPC if you are not using it,
- Configure your web server to block requests to /?author=<number>,
- Don’t expose /wp-admin and /wp-login.php directly to the public Internet.
Protecting from user enumeration is just one of many things you should do for a secure WordPress site. Read these WordPress security best practices which will help you harden your WordPress website.
