PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5487 Wordpress CVE debrief

CVE-2017-5487 is a WordPress 4.7 REST API information disclosure issue. According to the CVE record, the users controller did not properly restrict listings of post authors, allowing a remote attacker to obtain sensitive information through a wp-json/wp/v2/users request. The issue is rated medium severity and is fixed in WordPress 4.7.1.

Vendor
Wordpress
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-15
Original CVE updated
2026-05-13
Advisory published
2017-01-15
Advisory updated
2026-05-13

Who should care

Administrators of WordPress sites running version 4.7 or earlier, especially internet-facing sites that expose the REST API, should prioritize this update because the issue is reachable remotely and requires no authentication.

Technical summary

The vulnerable component is wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in WordPress 4.7. The CVE describes insufficient restriction of author/user listings in the REST API users endpoint, which can disclose sensitive information over the network without user interaction. NVD classifies the weakness as CWE-200 and lists affected WordPress versions up to 4.7, with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Defensive priority

Medium, with higher urgency for exposed WordPress 4.7 deployments because the flaw is remotely reachable and unauthenticated, and a vendor fix is available in 4.7.1.

Recommended defensive actions

  • Upgrade WordPress to 4.7.1 or later as the primary remediation.
  • Confirm that no WordPress 4.7 or earlier instances remain in production or on public-facing systems.
  • Review access logs for repeated wp-json/wp/v2/users requests and investigate unusual enumeration patterns.
  • Apply normal hardening for WordPress accounts and monitor for unexpected disclosure of author or username data.
  • Use the WordPress 4.7.1 release notes and associated patch reference to validate that the intended fix is present in your deployed build.

Evidence notes

This debrief is grounded in the supplied CVE description, NVD metadata, and the linked WordPress 4.7.1 release/patch references. The CVE description states that the REST API users controller in WordPress 4.7 before 4.7.1 did not properly restrict listings of post authors, enabling remote information disclosure via wp-json/wp/v2/users. NVD metadata confirms the affected version range, the CWE-200 classification, and the CVSS vector. Link contents were not independently fetched here, so assertions are limited to the provided record and reference metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5487 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5487

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5487 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5487

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.