# SPDX-License-Identifier: AGPL-3.0-only
# WordPress REST-API user enumeration, WHATEVER the answer: the WAF
# catches most (wp-user-enum-blocked insta-bans the 403s), this one is
# for a site where the endpoint answers — repeated harvesting of
# /wp-json/wp/v2/users is CVE-2017-5487 probing however it ends.
# Belongs in the THRESHOLD rule srv00-wp-user-enum, not an instant one:
# a site's own javascript may legitimately touch the endpoint once.
#
# Only the shapes an enumeration walks: the bare list, or /users/<id>
# by number. NEVER /users/me — that is the logged-in user asking about
# themselves, and a WordPress admin's own dashboard (Gutenberg,
# Elementor, W3TC…) polls it constantly (seen 2026-08-20: an operator
# in wp-admin, eleven polls in five minutes, banned as a harvester).
# And only WITHOUT a referer, like wp-scan-paths: harvesting tools send
# none; a browser in the site — wp-admin included — always names its
# page. A forged referer escapes this parser; the blocked form
# (wp-user-enum-blocked) and http-attack still stand behind it.
parser: wp-user-enum-rest
log: http
prefilter: "/wp-json/wp/"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/wp-json/wp/v\d+/users(?:/\d+)?)(?:\?(?P<query>[^ "]*))? [^"]*" \d{3} \d+ "-" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
