# Missing access control exposing detailed information on all users

Unauthenticated GET to WP REST API users endpoint with context=edit leaks usernames, emails, names, registration dates and privileges for all users.

- Payout: hidden
- Severity: high
- Program: WP API
- Found by: albinowax
- Disclosed: 2016-10-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/138244
- Library page: https://bugbountylibrary.com/r/h1%3A138244
- Tags: area:web domain:web impact:pii-leak kind:bounty platform:hackerone sev:high tech:rest tech:wordpress vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** WordPress REST API /wp-json/wp/v2/users endpoint
**Root cause:** The WP REST API plugin fails to enforce access controls on the 'edit' context for the users collection, so unauthenticated requests receive fields reserved for privileged contexts.
**Steps:**
1. Send unauthenticated request: `GET /wp-json/wp/v2/users?context=edit`
2. Observe response containing username, email, first/last name, registration date and privilege details for every registered user
**Exploitation:** Unauthenticated attacker enumerates all users and their emails/privileges in one request, then targets admin email addresses for credential attacks to gain webserver control.
**Insight:** REST API 'context' parameters (view/embed/edit) are a recurring WordPress access-control gap: try swapping context=edit on collection endpoints that normally return limited fields.