Description
If permalinks are enabled, in many WordPress installations it is possible to enumerate all the WordPress usernames iterating through the author archives. Whenever a post is published, the username or alias is shown as the author. For example, the URL http://site.com/?author=1 will show all the posts from user id 1. Attackers can abuse this functionality to figure out which usernames are available on the site.
Remediation
You can use an .htaccess rewrite rule to prevent this disclosure but you should also be sure to use nicknames to avoid disclosing usernames.
# Stop WordPress username enumeration vulnerability RewriteCond %{REQUEST_URI} ^/$ RewriteCond %{QUERY_STRING} ^/?author=([0-9]*) RewriteRule ^(.*)$ http://yoursite.com/somepage/? [L,R=301]
References
WordPress Username Enumeration Vulnerability
Exploiting & Remediating WordPress' User Enumeration Vulnerability ...
Related Vulnerabilities
Internet Information Server returns IP address in HTTP header (Content-Location)
Joomla! Core 2.5.x Information Disclosure (2.5.0 - 2.5.9)
WordPress Plugin iThemes Security (formerly Better WP Security) Information Disclosure (5.1.1)
Drupal Backup Migrate directory publicly accessible
WordPress Plugin VikBooking Hotel Booking Engine & PMS Multiple Vulnerabilities (1.5.3)