Member-only story
WordPress User Disclosure Vulnerability Reported on HackerOne
Free Article Link: Click here 👈
A recently disclosed report on HackerOne highlights a critical vulnerability involving the exposure of WordPress user data through XML sitemaps. Here’s a breakdown of the findings:
Background
WordPress utilizes XML sitemaps to improve SEO by indexing posts, tags, and other content for search engines. While these sitemaps typically include publicly available content, a security researcher discovered a critical oversight in a specific implementation.
The Vulnerability
In this case, the affected WordPress instance had an enabled author-sitemap.xml file (e.g., https://www.payapps.com/author-sitemap.xml), which publicly listed user accounts, including administrative usernames and associated email addresses. This exposure poses two key risks:
- Username Harvesting: Attackers can compile valid usernames, including privileged accounts.
- Targeted Brute Force Attacks: With valid usernames exposed, malicious actors can launch focused brute force…
