Does WordPress expose user information?

Yes, WordPress exposes user information through several default features. The REST API endpoint /wp-json/wp/v2/users lists all registered users with their usernames, display names, and profile URLs. Author archive pages at /?author=1 reveal usernames through URL redirects. Login error messages differentiate between invalid usernames and wrong passwords, confirming valid accounts. RSS feeds may include author information. This user enumeration helps attackers identify valid admin accounts for brute-force attacks. Disable user enumeration by restricting the REST API, removing author archives, and using generic login error messages. UNPWNED checks bounded publicly accessible user-enumeration paths and reports observed exposure; it does not perform credential attacks.