What’s Vulnerable › Vulnerabilities
CVE-2025-4302: Stop User Enumeration < 1.7.3 - Protection Bypass
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-07-17 · updated 2026-06-17
Description
The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path.
Affected products
- Stop User Enumeration: before 1.7.3 — fixed in 1.7.3
How to fix
Upgrade to a fixed version: Stop User Enumeration 1.7.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-4302 or the next vulnerability affects your stack