Every CVE Search/ Get API key

CVE-2017-5487

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation...

5.3 MediumPublic exploitFix available

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

87.3%Up 76.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Record
CVE-2017-5487
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Record
CVE-2017-5487
Updated
2026-11-02
EUVDEUVD-2017-14591 No score

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Record
EUVD-2017-14591
Updated
2026-11-03
GitHub AdvisoriesGHSA-94q7-f538-38mf 5.3

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation...

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Record
GHSA-94q7-f538-38mf
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 5.3

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Record
CVE-2017-5487
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-5487 5.3

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Record
DEBIAN-CVE-2017-5487
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wordpress
Debian:12
 before 4.7.1+dfsg-1
4.7.1+dfsg-1
wordpress
Debian:13
 before 4.7.1+dfsg-1
4.7.1+dfsg-1
wordpress
Debian:14
 before 4.7.1+dfsg-1
4.7.1+dfsg-1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBWordPress Core < 4.7.1 - Username Enumeration2017-03-03
PoC in GitHubGeunSam2/CVE-2017-54872019-06-10
PoC in GitHubR3K1NG/wpUsersScan2018-02-17
PoC in GitHubSeasonLeague/CVE-2017-54872023-01-29
PoC in GitHubdream434/CVE-2017-54872024-05-27
PoC in GitHubndr-repo/CVE-2017-54872025-05-10
PoC in GitHubpatilkr/wp-CVE-2017-5487-exploit2020-04-26
PoC in GitHubteambugsbunny/wpUsersScan2017-10-22
PoC in GitHubtpdlshdmlrkfmcla/cve-2017-54872025-03-08
PoC in GitHubzkhalidul/GrabberWP-CVE-2017-54872021-11-04

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5487 is a medium vulnerability (CVSS 5.3) in Wordpress, published January 15, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 87.3%, the 99th percentile. Fixed in wordpress 4.7.1+dfsg-1.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open