### [CVE-2017-5487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5487)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

### POC

#### Reference
- https://wpvulndb.com/vulnerabilities/8715
- https://www.exploit-db.com/exploits/41497/

#### Github
- https://github.com/0v3rride/Week-7
- https://github.com/0xPugal/One-Liners
- https://github.com/0xPugazh/One-Liners
- https://github.com/20142995/sectool
- https://github.com/AAp04/Codepath-Week-7
- https://github.com/AAp04/WordPress-Pen-Testing
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/DannyLi804/CodePath-Pentesting
- https://github.com/GeunSam2/CVE-2017-5487
- https://github.com/K3ysTr0K3R/CVE-2017-5487-EXPLOIT
- https://github.com/K3ysTr0K3R/K3ysTr0K3R
- https://github.com/LeakIX/l9explore
- https://github.com/LeakIX/l9plugins
- https://github.com/MRKWP/mrkwp-rest-permissions
- https://github.com/PatyRey/Codepath-WordPress-Pentesting
- https://github.com/Polem4rch/Brutepress
- https://github.com/R3K1NG/wpUsersScan
- https://github.com/Ravindu-Priyankara/CVE-2017-5487-vulnerability-on-NSBM
- https://github.com/SeasonLeague/CVE-2017-5487
- https://github.com/Sechunt3r/wpenum
- https://github.com/Tamie13/Red-Team-Summary-of-Operations
- https://github.com/WangYihang/Exploit-Framework
- https://github.com/anx0ing/Wordpress_Brute
- https://github.com/bensonmacharia/Pentest-Scripts
- https://github.com/bhavesh-pardhi/One-Liner
- https://github.com/d4n-sec/d4n-sec.github.io
- https://github.com/fortify24x7/wpUsersScan
- https://github.com/gboddin/l9-nuclei-plugin
- https://github.com/htrgouvea/spellbook
- https://github.com/justinw238/codepath_7_jlw15
- https://github.com/kr4dd/CVE-2017-5487
- https://github.com/largewaste/cqr
- https://github.com/natlarks/Week7-WordPressPentesting
- https://github.com/patilkr/wp-CVE-2017-5487-exploit
- https://github.com/ryanfantus/codepath-week-7
- https://github.com/teambugsbunny/wpUsersScan
- https://github.com/uoanlab/vultest
- https://github.com/zkhalidul/GrabberWP-CVE-2017-5487