Security Concern: Public User Directory Exposes Usernames

Security Concern: Public User Directory Exposes Usernames Plugin: UsersWP Issue Type: Security / Privacy Severity: Medium to High Summary The UsersWP plugin creates a publicly accessible user directory at /users/ that allows anyone (including non-logged-in visitors) to view and enumerate all WordPress usernames on the site. This creates a significant security vulnerability. How I Discovered This I discovered this issue when Google Search Console reported it was attempting to index the URL: https://example.com/users/?uwp_sort_by=display_name_asc Fortunately, Google couldn’t index it in my case, but the page was fully accessible to anyone who knew or guessed the URL. Security Impact Username Enumeration : Attackers can harvest a complete list of all WordPress usernames, which represents half of the login credentials needed for brute force attacks. Targeted Attacks : Having valid usernames makes brute force attacks significantly easier and more effective. Privacy Violation : Users may not consent to having their information publicly listed and searchable. Social Engineering : Exposed user information can be used for phishing and targeted social engineering attacks. SEO/Privacy : Search engines may index this sensitive information, making it permanently available even if later restricted. Current Workarounds While UsersWP does offer an option to manually exclude specific users from the directory, this is not a scalable or secure solution: New users are exposed by default Requires manual maintenance for each user Easy to overlook or forget Does not address the fundamental security issue Recommended Solution The plugin should include a privacy/access control setting that allows site administrators to: Restrict access to logged-in users only (default) Restrict access to specific user roles (e.g., members only, subscribers only) Make completely private (administrators only) Public access (with clear security warning) This would be similar to how many other member directory plugins handle privacy (BuddyPress, Ultimate Member, etc.). Temporary Fix for Site Owners Until this is addressed in the plugin, site owners can add this code to their child theme’s functions.php : /** * Security: Restrict UsersWP directory to administrators only * Prevents username enumeration */ add_action('template_redirect', function() { if (strpos($_SERVER['REQUEST_URI'], '/users/') !== false) { if (!current_user_can('manage_options')) { wp_die( '<h1>Access Denied</h1><p>You do not have permission to access this page.</p>', 'Access Denied', array('response' => 403, 'back_link' => true) ); exit; } } }, 1); Request to Developers Could the UsersWP team please consider adding proper access control settings for the user directory? This would greatly improve the security posture of sites using this plugin and align with WordPress security best practices. I appreciate the plugin and especially love the professional login page integration – just hoping we can address this security concern. Thank you for your consideration! Additional Notes: I’m happy to provide more details or testing if needed This was reported in good faith to help improve the plugin Using UsersWP version: Version 1.2.45 WordPress version: Version 6.8.3 Hi Joe, Please see https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-disclosures-of-usernames-or-user-ids-not-a-security-issue The WordPress project doesn’t consider usernames or user ids to be private or secure information There are also many ways to restrict it of you so desire. Thanks, Stiofan Creating a directory of the website users is a feature of the plugin, definitely not a security concern. If you don’t want to expose it, simply use a content control plugin (UsersWP Membership or a free plugin like content control) or even easier, delete the /users/ page. If the problem is users may not consent to be listed, the privacy option in the account page allows them to be excluded from the users page.