CVE-2025-9209: Exposure of Sensitive Information to an Unauthorized Actor

The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated...

CVE-2017-5487

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request...

CVE-2017-5487: Exposure of Sensitive Information to an Unauthorized Actor

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request...

PT-2017-16528

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7 through 4.7.0 Description The issue allows remote attackers to obtain sensitive information. This is due to the REST API implementation not properly restricting listings of post authors. Attackers can exploit this via a...