WordPress Username Exposure via Sitemap on Payapps.com | Bug Bounty

 

Hello, fellow cyber defenders!
In today’s post, we’re diving into a low-hanging fruit vulnerability that often gets overlooked — but can have serious consequences if left unpatched.

A WordPress misconfiguration was spotted on Payapps.com, where the site's author-sitemap.xml file was publicly available. This exposed internal usernames, making it easier for attackers to conduct brute-force login attacks or craft phishing emails targeting employees.

What Was the Issue?

While doing routine reconnaissance, security researcher karimtantawy found that Payapps.com had its author sitemap open to the public at:

🔗 https://www.payapps.com/author-sitemap.xml

This file is typically created by SEO plugins (like Yoast) to help search engines discover author pages — but if not properly configured, it can expose real usernames used for login.

How an Attacker Could Exploit This

Here’s a basic outline of how this kind of information can be misused:

1. Access the Author Sitemap

• Simply visit the URL: /author-sitemap.xml

• It shows a list of author URLs (e.g., /author/username)

2. Collect Valid Usernames

• Extract the usernames directly from the URL paths

• These are often used as login usernames on WordPress admin panels

3. Launch an Attack

• Use automated tools to try passwords for these known usernames

• Or send phishing emails pretending to be a coworker or internal team member
  
  
  

  
  
  

  Disclosure Details

• Reported to: Autodesk (owner of Payapps.com)

• Report ID: #2981756

• Severity: Medium

• Type: Information Disclosure / User Enumeration

• Status: Marked Informative (no bounty awarded)

Why This Matters

While it might sound harmless to expose author names, every piece of leaked information helps an attacker build their profile. Brute-force attacks become easier, and phishing becomes more convincing.

It’s always a good idea to:

• Disable author sitemaps unless required

• Rename or obfuscate admin usernames

• Enforce strong passwords and enable 2FA
  

Credits

Props to karimtantawy for responsibly reporting the issue and helping improve security across the board. This kind of disclosure strengthens the WordPress ecosystem for everyone.

Stay safe, stay updated, and keep hunting those bugs!