# CVE-2017-5487: WordPress REST API information disclosure in users controller

Source: https://junglewise.ai/threats/cve-2017-5487-wordpress-rest-api-information-disclosure-in-users-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-15. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5487 · Severity: medium · CVSS 5.3 · Published 2017-01-15

WordPress, a popular website management platform, contained a flaw in its REST API that allowed public access to user information. An attacker could use this to list all users who have authored public posts, potentially facilitating targeted attacks or password guessing. This issue was resolved in version 4.7.1.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2017-5487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5487 being exploited in the wild.

**How severe is CVE-2017-5487?** Medium severity, with a CVSS score of 5.3, published 15 January 2017.

**Which products and versions are affected?** WordPress WordPress 4.7 before 4.7.1.

**Is there a fix for CVE-2017-5487?** A patch was published on 2017-01-11: WordPress 4.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5487 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2017-5487?** Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in 'wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php' within the WordPress REST API. In version 4.7, the API did not sufficiently restrict the listing of users who had authored public posts, allowing unauthenticated remote attackers to perform username harvesting by querying the 'wp-json/wp/v2/users' endpoint. The fix introduced in version 4.7.1 restricts this listing to only include post types specifically configured to be shown within the REST API. This is a classic CWE-200 (Information Exposure) issue that can be exploited via a simple GET request without any special privileges or user interaction.

## Affected products

- WordPress WordPress 4.7 before 4.7.1

## Timeline

- 2017-01-11: patched: WordPress 4.7.1 released
- 2017-01-14: disclosed: Public disclosure via oss-security mailing list
- 2017-01-15: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2017/01/14/6](http://www.openwall.com/lists/oss-security/2017/01/14/6)
- [http://www.securityfocus.com/bid/95391](http://www.securityfocus.com/bid/95391)
- [http://www.securitytracker.com/id/1037591](http://www.securitytracker.com/id/1037591)
- [https://codex.wordpress.org/Version_4.7.1](https://codex.wordpress.org/Version_4.7.1)
- [https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60](https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60)
- [https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/](https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/)
- [https://wpvulndb.com/vulnerabilities/8715](https://wpvulndb.com/vulnerabilities/8715)

## Related threats

- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)
- [WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt)
- [WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling)