WordPress versions 6.4.3 and below appear to suffer from a REST API related username disclosure vulnerability.