CVE-2025-4302: Stop User Enumeration Auth Bypass Flaw

CVE-2025-4302 Overview

CVE-2025-4302 affects the Stop User Enumeration WordPress plugin in versions before 1.7.3. The plugin is designed to block unauthenticated requests to the REST API endpoint /wp-json/wp/v2/users/, preventing anonymous discovery of WordPress usernames. Attackers can bypass this protection by URL-encoding the API path, causing the plugin's path-matching logic to fail while WordPress still routes the request to the users endpoint. Successful exploitation exposes WordPress account names to unauthenticated remote attackers, providing intelligence for follow-on credential attacks.

Critical Impact
Unauthenticated attackers can enumerate WordPress usernames despite the plugin being installed, undermining the plugin's core security function and enabling targeted brute-force campaigns.

Affected Products

Fullworksplugins Stop User Enumeration WordPress plugin, all versions prior to 1.7.3
WordPress sites relying on this plugin as a control against user enumeration
Sites exposing the WordPress REST API at /wp-json/wp/v2/users/

Discovery Timeline

2025-07-17 - CVE-2025-4302 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4302

Vulnerability Analysis

Stop User Enumeration inspects incoming HTTP requests and blocks unauthenticated access to the WordPress REST API users route. The plugin compares the requested URI against the literal string /wp-json/wp/v2/users/ to decide whether to reject the request. This comparison is performed before WordPress normalizes the URL path.

An attacker who percent-encodes characters in the path, for example replacing / with %2F or letters with their %xx equivalents, produces a URI that no longer matches the plugin's filter. WordPress subsequently decodes the path during routing and dispatches the request to the users endpoint. The response contains the JSON list of user accounts, defeating the plugin's protection. This is an authorization bypass caused by inconsistent URL canonicalization between the security control and the underlying router.

Root Cause

The root cause is Improper Input Validation combined with an Authorization Bypass pattern. The plugin performs a case-sensitive, literal string match against the raw request path instead of decoding and normalizing the URI before applying its access control decision. Any encoding transformation that preserves semantic meaning to WordPress but changes the raw string evades the check.

Attack Vector

Exploitation requires only network access to the target site and no authentication or user interaction. An attacker issues a single HTTP GET request to a URL-encoded variant of the users endpoint, such as /wp-json/wp/v2/users%2F or paths using encoded alphabetic characters. The server returns a JSON payload enumerating WordPress users, including id, name, and slug fields. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2025-4302

Indicators of Compromise

Access log entries containing URL-encoded variants of the users endpoint, such as %2Fwp-json%2Fwp%2Fv2%2Fusers or /wp-json/wp/v2/users%2F
Successful HTTP 200 responses to /wp-json/wp/v2/users* from unauthenticated source IPs
Bursts of requests from a single IP scanning multiple encoding permutations of the users route
Follow-on authentication attempts targeting usernames returned by the endpoint

Detection Strategies

Alert on any REST API request whose decoded path matches /wp-json/wp/v2/users/ when the request lacks a valid authenticated session cookie or application password
Compare the raw request URI against the decoded URI in web server or WAF logs and flag mismatches targeting sensitive routes
Baseline normal REST API consumers and alert on unauthenticated clients accessing the users endpoint

Monitoring Recommendations

Enable verbose logging on wp-json routes and forward web server logs to a centralized analytics platform
Track WordPress plugin versions across the estate and alert when Stop User Enumeration is below 1.7.3
Correlate user enumeration attempts with subsequent XML-RPC or wp-login.php brute-force activity from the same source

How to Mitigate CVE-2025-4302

Immediate Actions Required

Update the Stop User Enumeration plugin to version 1.7.3 or later on every affected WordPress site
Audit web server logs for prior URL-encoded requests to the users REST endpoint and identify exposed usernames
Rotate passwords and enforce multi-factor authentication for any accounts whose names were disclosed
Restrict access to /wp-json/wp/v2/users/ at the web server or WAF layer for unauthenticated clients

Patch Information

The vendor addressed CVE-2025-4302 in Stop User Enumeration version 1.7.3. Administrators should upgrade through the WordPress plugin dashboard or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Block unauthenticated requests to /wp-json/wp/v2/users and any percent-encoded variants at the reverse proxy or WAF
Disable the WordPress REST API users endpoint via a rest_endpoints filter if the site does not require public user listings
Require authentication for the entire REST API by returning WP_Error from rest_authentication_errors when no user is logged in

bash

# NGINX configuration example to block encoded and unencoded user enumeration
location ~* "/wp-json/wp/v2/users" {
    return 401;
}
location ~* "%2fwp-json%2fwp%2fv2%2fusers" {
    return 401;
}