Hacker News new | ask | show | jobs
by mr__y 2602 days ago
> I'm not 100% sure it's not leaking somewhere I missed

have you checked the REST endpoint?, namely site.tld/wp-json/wp/v2/users

By default all user names are exposed that way.