CVE-2025-4302

MEDIUM NUCLEI

Stop User Enumeration <1.7.3 - Auth Bypass

Title source: llm

Description

The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path.

Exploits (1)

github WORKING POC 4 stars
by halilkirazkaya · poc
https://github.com/halilkirazkaya/cve-poc-garage/tree/main/2025/CVE-2025-4302.md

Nuclei Templates (1)

Stop User Enumeration WordPress plugin - Authentication Bypass
MEDIUMVERIFIEDby Kazgangap
Shodan: http.html:"/wp-content/plugins/stop-user-enumeration/"
FOFA: body=/wp-content/plugins/stop-user-enumeration/

References (1)

Scores

CVSS v3 5.3
EPSS 0.0110
EPSS Percentile 78.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

Status published
Products (1)
fullworksplugins/stop_user_enumeration < 1.7.3
Published Jul 17, 2025
Tracked Since Feb 18, 2026