Back to blog
WordPresstechnicalvulnerabilities

WordPress REST API: 7 dangerous endpoints enabled by default

Published on 2026-04-036 min readFlorian

WordPress exposes more than you think

By default, WordPress enables a complete REST API accessible to any visitor.

Endpoint 1: /wp-json/wp/v2/users

Lists all users with names and slugs.

Endpoint 2: /wp-json/acf/v3/options

ACF Pro can return ALL site options — including API keys and tokens.

Endpoint 3: /wp-json/wp/v2/media

Enumeration of all uploaded files. Sequential IDs = download private files.

Endpoints 4-7: Custom namespaces

Every plugin registering a REST namespace creates potentially unauthenticated endpoints.

Related articles

Three adjacent analyses to keep exploring the same attack surface.

Sources

Written by Florian
Reviewed on 2026-04-03

Editorial analysis based on official vendor, project, and regulator documentation.

Related services

If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.

Need an external review of your HR SaaS?

Share your product, stack, and client context. We will come back with the right review scope.

Discuss your audit