cve/cves/2017/CVE-2017-5487.md

CVE-2017-5487

Description

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

POC

Reference

• https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60
• https://wpvulndb.com/vulnerabilities/8715
• https://www.exploit-db.com/exploits/41497/

Github

• https://github.com/GeunSam2/CVE-2017-5487
• https://github.com/Jhonsonwannaa/CVE-2017-5487
• https://github.com/MRKWP/mrkwp-rest-permissions
• https://github.com/SeasonLeague/CVE-2017-5487
• https://github.com/dream434/CVE-2017-5487
• https://github.com/mr-won/cve-2017-5487
• https://github.com/ndr-repo/CVE-2017-5487
• https://github.com/ndr-repo/PSRedTeam
• https://github.com/patilkr/wp-CVE-2017-5487-exploit
• https://github.com/tpdlshdmlrkfmcla/cve-2017-5487
• https://github.com/user20252228/cve-2017-5487
• https://github.com/zkhalidul/GrabberWP-CVE-2017-5487

ExploitDB

• https://www.exploit-db.com/exploits/41497

Nuclei

• https://github.com/linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2017-5487-3022.yaml

Collections

• https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2017/CVE-2017-5487.yaml