What it is

The WordPress REST API publicly lists real usernames. An attacker uses this to build a precise list of accounts to target with password-guessing, instead of guessing blindly.

How to fix it

Block REST-API user enumeration — the WordPress Plugin's Security tab does this automatically.

In depth

Your WordPress site's REST API is currently showing a public list of all your usernames, which is like having a directory of employee names posted on your front door. An attacker can use this list to target your accounts with password-guessing attacks, making their job much easier instead of them having to guess randomly which accounts even exist on your site. This matters because once they know your usernames like "admin" or "john.smith," they can run automated attacks specifically against those accounts, significantly increasing the risk of a successful break-in. The fix is simple and automatic: your security plugin can block access to this username information through what's called the REST API, essentially removing that public directory so attackers can't see who has accounts on your site. Once you enable this protection in your security plugin's settings, the REST API will continue working normally for legitimate purposes while hiding your username list from would-be attackers.