**Hi!** Team @yelp, We Found Multiple Vulnerabilities in you websites , Username Admin Login Sensitive Exposure Refferals Hackerone [#753725] Platform(s) Affected: [website] *. https://blog.yelp.com/wp-json/ ``user-admin sensitive exposure`` *. https://blog.yelp.com/wp-login.php ``Admin-Page disclousure`` ##Steps To Reproduce: 1) Open URL Vulnerable : https://blog.yelp.com/wp-json/ **Request** ``` GET /wp-json/ HTTP/1.1 Host: blog.yelp.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://127.0.0.1:8080 DNT: 1 Connection: close Cookie: __cfduid=dc46e8e6b98de504f3f044d1b9b3b8a191579632970 Upgrade-Insecure-Requests: 1 ``` **Vulnerable Details** Add Parameter ``Origin`` in Request Header ``Origin`` http://127.0.0.1:8080 **Exploit Cross Origin Resource Sharing Misconfiguration** ```javascript

Steal customer data!

``` 2) save file as ``.html`` , and open in your browser 3) **Boom** Sensitive has been Exposure **Additional information** ```javascript name "Yelp" description "Official Blog" url "https://blog.yelp.com" home "https://blog.yelp.com" gmt_offset -8 timezone_string "America/Los_Angeles" namespaces […] authentication [] routes / {…} /oembed/1.0 {…} /oembed/1.0/embed {…} /oembed/1.0/proxy {…} //wpe_sign_on_plugin/v1 {…} /wpe_sign_on_plugin/v1/login {…} /redirection/v1 {…} /redirection/v1/redirect {…} /redirection/v1/redirect/(?P[\d]+) {…} /redirection/v1/bulk/redirect/(?Pdelete|enable|disable|reset) {…} /redirection/v1/group {…} /redirection/v1/group/(?P[\d]+) {…} /redirection/v1/bulk/group/(?Pdelete|enable|disable) {…} /redirection/v1/log {…} /redirection/v1/bulk/log/(?Pdelete) {…} /redirection/v1/404 {…} /redirection/v1/bulk/404/(?Pdelete) {…} /redirection/v1/setting {…} /redirection/v1/plugin {…} /redirection/v1/plugin/delete {…} /redirection/v1/plugin/test {…} /redirection/v1/plugin/post {…} /redirection/v1/plugin/database {…} /redirection/v1/import/file/(?P\d+) {…} /redirection/v1/import/plugin {…} /redirection/v1/import/plugin/(?P.*?) {…} /redirection/v1/export/(?P1|2|3|all)/(?Pcsv|apache|nginx|json) {…} /yoast/v1 {…} /yoast/v1/configurator {…} /yoast/v1/reindex_posts {…} /yoast/v1/ryte {…} /yoast/v1/indexables/(?P\w+)/(?P\d+) {…} /yoast/v1/file_size {…} /yoast/v1/statistics {…} /yoast/v1/myyoast {…} /yoast/v1/myyoast/connect {…} /wp-rest-api-log {…} /wp-rest-api-log/entries {…} /wp-rest-api-log/entry/(?P[\d]+) {…} /wp-rest-api-log/entry {…} /wp-rest-api-log/routes {…} /wp-rest-api-log/entry/(?P[\d]+)/(?Prequest)/(?Pbody_params)/download {…} /wp-rest-api-log/entry/(?P[\d]+)/(?Prequest)/(?Pquery_params)/download {…} /wp-rest-api-log/entry/(?P[\d]+)/(?Prequest)/(?Pbody)/download {…} /wp-rest-api-log/entry/(?P[\d]+)/(?Prequest)/(?Pheaders)/download {…} /wp-rest-api-log/entry/(?P[\d]+)/(?Presponse)/(?Pbody)/download {…} /wp-rest-api-log/entry/(?P[\d]+)/(?Presponse)/(?Pheaders)/download {…} /metaslider/v1 {…} /metaslider/v1/slideshow/all {…} /metaslider/v1/slideshow/preview {…} /metaslider/v1/slideshow/save {…} /metaslider/v1/slideshow/delete {…} /metaslider/v1/slideshow/duplicate {…} /metaslider/v1/themes/all {…} /metaslider/v1/themes/custom {…} /metaslider/v1/themes/set {…} /metaslider/v1/import/images {…} /metaslider/v1/tour/status {…} /metaslider/v1/settings/save-single {…} /metaslider/v1/settings/save-global {…} /regenerate-thumbnails/v1 {…} /regenerate-thumbnails/v1/regenerate/(?P[\d]+) {…} /regenerate-thumbnails/v1/attachmentinfo/(?P[\d]+) {…} /regenerate-thumbnails/v1/featuredimages {…} /wp/v2 {…} /wp/v2/posts {…} /wp/v2/posts/(?P[\d]+) {…} /wp/v2/posts/(?P[\d]+)/revisions {…} /wp/v2/posts/(?P[\d]+)/revisions/(?P[\d]+) {…} /wp/v2/posts/(?P[\d]+)/autosaves {…} /wp/v2/posts/(?P[\d]+)/autosaves/(?P[\d]+) {…} /wp/v2/pages {…} /wp/v2/pages/(?P[\d]+) {…} /wp/v2/pages/(?P[\d]+)/revisions {…} /wp/v2/pages/(?P[\d]+)/revisions/(?P[\d]+) {…} /wp/v2/pages/(?P[\d]+)/autosaves {…} /wp/v2/pages/(?P[\d]+)/autosaves/(?P[\d]+) {…} /wp/v2/media {…} /wp/v2/media/(?P[\d]+) {…} /wp/v2/blocks {…} /wp/v2/blocks/(?P[\d]+) {…} /wp/v2/blocks/(?P[\d]+)/autosaves {…} /wp/v2/blocks/(?P[\d]+)/autosaves/(?P[\d]+) {…} /wp/v2/wp-rest-api-log {…} /wp/v2/wp-rest-api-log/(?P[\d]+) {…} /wp/v2/wp-rest-api-log/(?P[\d]+)/autosaves {…} /wp/v2/wp-rest-api-log/(?P[\d]+)/autosaves/(?P[\d]+) {…} /wp/v2/types {…} /wp/v2/types/(?P[\w-]+) {…} /wp/v2/statuses {…} /wp/v2/statuses/(?P[\w-]+) {…} /wp/v2/taxonomies {…} /wp/v2/taxonomies/(?P[\w-]+) {…} /wp/v2/categories {…} /wp/v2/categories/(?P[\d]+) {…} /wp/v2/tags {…} /wp/v2/tags/(?P[\d]+) {…} /wp/v2/users {…} /wp/v2/users/(?P[\d]+) {…} /wp/v2/users/me {…} /wp/v2/comments {…} /wp/v2/comments/(?P[\d]+) {…} /wp/v2/search {…} /wp/v2/block-renderer/(?Pcore/block) {…} /wp/v2/block-renderer/(?Pcore/latest-comments) {…} /wp/v2/block-renderer/(?Pcore/archives) {…} /wp/v2/block-renderer/(?Pcore/calendar) {…} /wp/v2/block-renderer/(?Pcore/categories) {…} /wp/v2/block-renderer/(?Pcore/latest-posts) {…} /wp/v2/block-renderer/(?Pcore/rss) {…} /wp/v2/block-renderer/(?Pcore/search) {…} /wp/v2/block-renderer/(?Pcore/shortcode) {…} /wp/v2/block-renderer/(?Pcore/tag-cloud) {…} /wp/v2/settings {…} /wp/v2/themes {…} _links {…} ``` ##POC Screenshots/Videos: * F691740 * F691742 * F691741 ## Impact 1. This website using Wordpress , so developer forget to disable the link that can view information of admin user. By access to this link, attacker can get all username and other information of user admin: Wordpress user admin sensitive-exposure 2. Cross Origin Resource Sharing Misconfiguration

Query Builder