CVE-2025-4302

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4302
The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/19f67d6e-4ffe-4126-ac42-fb23c5017a3e Third Party Advisory Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:fullworks:stop_user_enumeration:*:*:*:*:*:wordpress:*:*
History

02 Jan 2026, 21:04

Type Values Removed Values Added
CWE NVD-CWE-noinfo
First Time Fullworks
Fullworks stop User Enumeration
CPE cpe:2.3:a:fullworks:stop_user_enumeration:*:*:*:*:*:wordpress:*:*
References () https://wpscan.com/vulnerability/19f67d6e-4ffe-4126-ac42-fb23c5017a3e - () https://wpscan.com/vulnerability/19f67d6e-4ffe-4126-ac42-fb23c5017a3e - Third Party Advisory, Exploit
Summary
  • (es) El complemento Stop User Enumeration de WordPress (versión anterior a la 1.7.3) bloquea las solicitudes de la API REST /wp-json/wp/v2/users/ para usuarios no autorizados. Sin embargo, esto se puede evitar codificando la ruta de la API en URL.

17 Jul 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

17 Jul 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-17 08:15

Updated : 2026-01-02 21:04

NVD link : CVE-2025-4302

Mitre link : CVE-2025-4302

CVE.ORG link : CVE-2025-4302

JSON object : View

Products Affected

fullworks

  • stop_user_enumeration
CWE
NVD-CWE-noinfo