Brute-force cracking for WordPress background Logon

WorkPress uses an "author" parameter. This parameter accepts a number as the value and returns the page corresponding to the user ID.
Example: http://www.bkjia.com /? Author = 1
The following problems exist:
1. user IDs increase sequentially.
2. If the user with this ID exists, a page containing the user name is returned.
These problems may cause the following attacks:
1. Check whether the user ID exists through the request
2. The returned page exposes the user name corresponding to the user ID.
Attackers may traverse some IDs. In this way, we can enumerate all the user names in the system.
Affected Versions:
2.6, 3.1, 3.1.1, 3.1.3, 3.2-beta2, and other versions may also be affected.
The verification principle is simple:
Request http://www.bkjia.com /? Author = 1 (here 1 can be replaced with other numbers)
Then, filter the username field on the returned page (note the differences between different language versions) to traverse the username in wordpress.

From Shine's holy heaven-Min Chen 〃