CVE-2017-5487

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict…

published January 15, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.

CVSS
—
EPSS
87%
Percentile
99.8
In the wild
Unconfirmed
What it is

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.87299 · 99.8th percentile
Published
2017-01-15T02:00Z
EPSS history
Timeline
  • 22 SEP 03:14Z
    EPSS moved 87% → 77%
    epss
  • 06 SEP 03:10Z
    EPSS moved 87% → 77%
    epss
  • 30 AUG 15:59Z
    EPSS moved 77% → 87%
    epss
  • 29 AUG 04:25Z
    EPSS moved 87% → 77%
    epss
  • 15 JAN 02:00Z
    wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict…
    cvelistv5