WordPress Core < 3.1.3 - Username Enumeration

Reaching this weakness in WordPress 3.1 <= 3.1.2 takes a caller who can reach the endpoint. An observable response discrepancy means the system answers two different situations in two distinguishable ways, so the difference itself carries information the caller was not meant to have.

An attacker enumerates valid accounts, emails or records by reading the difference, which turns a blind guess into a targeted one before any password is tried. For WordPress 3.1 the fix is 3.1.3: builds <= 3.1.2 are affected, anything from 3.1.3 onward is not.