How Hackator works
Three simple steps to secure your website with AI. Submit, AI analyzes, get your report.
Submit your URL
Enter the website URL you want to test. Our AI-powered platform accepts any publicly accessible website — no setup or configuration required. Just paste your URL and hit scan.
AI analyzes your vulnerabilities
Our AI engine and security experts perform a thorough vulnerability assessment. We check for XSS, SQL injection, misconfigurations, outdated dependencies, and more using advanced AI analysis.
Get your security report
Download a detailed AI-generated PDF report with findings, severity levels, proof of concept, and smart remediation guidance. Access it from your dashboard anytime.
HACKATOR
Security Assessment Report
Summary
The WordPress REST API endpoint /wp-json/wp/v2/users on blog.pub.us-west-2.prd.23andme.us returns a list of WordPress users including their IDs, display names, and email-derived slugs without requiring authentication.
Description
The WordPress REST API /wp-json/wp/v2/users endpoint is accessible without authentication on the internal backend. It returns user objects containing user IDs, display names, and URL slugs. The slugs are derived from internal email addresses (e.g., alehman23andme-com → [email protected]), directly exposing employee email addresses.
Steps To Reproduce
Send a GET request to: curl -s https://blog.pub.../wp-json/wp/v2/users
Observe the JSON response containing user data
Extract email addresses from the slug field by reversing the slug encoding
Proof of Concept
GET /wp-json/wp/v2/users HTTP/1.1 Host: blog.pub.us-west-2.prd.23andme.us Response: HTTP/1.1 200 OK [{ "id": 10, "name": "Alisa Lehman", "slug": "alehman23andme-com" }, ...]
Derived email addresses:
Impact
Attackers can enumerate all WordPress user accounts and their IDs, extract internal employee email addresses for phishing campaigns, and use discovered usernames for targeted brute-force or credential stuffing attacks against wp-login.php.
Recommended Fix
Implement authentication (API key or HMAC signature) on all webhook endpoints
Implement rate limiting and CAPTCHA to prevent spam abuse
Remove webhook URLs from public JavaScript bundles; use server-side proxies
Implement webhook secret validation (HMAC-SHA256 signature)
Audit all workflows triggered by public webhooks