Vulnerabilities / Wordfence Security – Firewall & Malware Scan / WPSEC-2026-0002
Wordfence Security – Firewall & Malware Scan <= 9.0.1 - Unauthenticated Author Information Disclosure via REST API Username Enumeration Protection Bypass
Medium 5.3
CWE-200Fixed in 9.0.2
- ID
- WPSEC-2026-0002
- Plugin
- Wordfence Security – Firewall, Malware Scan, and Login Security (wordfence)
- Affected
- from 6.2.8 before 9.0.2
- Remediation
- Update to 9.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Wordfence Security – Firewall & Malware Scan on WPSec AttackSurface
- Fix released
- Published
Description
The Wordfence Security plugin for WordPress is vulnerable to Information Disclosure in versions 6.2.8 up to, and including, 9.0.1 because the 'Prevent discovery of usernames through the WordPress REST API' protection validated the user ID parsed from the route rather than the 'id' parameter the users endpoint actually uses. This makes it possible for unauthenticated attackers to bypass the protection when it is enabled and retrieve author information (display name and slug) for users with published posts, for example via /wp-json/wp/v2/users/0?id=1.
References
- https://wpsec.com/vuln/WPSEC-2026-0002/
- https://plugins.svn.wordpress.org/wordfence/tags/9.0.2/
- https://wordpress.org/plugins/wordfence/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS