Description
WordPress includes a REST API that can be used to list the information about the registered users on a WordPress installation. The REST API exposed user data for all users who had authored a post of a public post type. WordPress 4.7.1 limits this to only post types which have specified that they should be shown within the REST API.
Remediation
Install a WordPress plugin such as Stop User Enumeration. Stop User Enumeration is a security plugin designed to detect and prevent hackers scanning your site for user names.
References
Related Vulnerabilities
WordPress Plugin Debug Log Manager Information Disclosure (2.2.2)
WordPress 6.1.x Multiple Vulnerabilities (6.1 - 6.1.3)
Atlassian Jira Manage Filters information disclosure
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4901)
WordPress Plugin MiwoFTP-File & Folder Manager Arbitrary File Download (1.0.5)