Fix CVE-2017-5487 vulnerability

When WordPress enabled the REST API in Core in version 4.7 it enabled the endpoint /wp-json/wp/v2/users/ to list all users that have posted something to the site. Therefore that endpoint can be used by an attacker to find some or all of the administrator account usernames to target for password cracking which is a potential security risk.

You can add a filter function to your functions.php in the current theme (wp-content/themes/your-theme/functions.php):

add_filter( 'rest_endpoints', 'secure_rest_endpoints' );

function secure_rest_endpoints( $endpoints ) {
    if ( isset( $endpoints['/wp/v2/users'] ) ) {
        unset( $endpoints['/wp/v2/users'] );
    }

    return $endpoints;
}

This will block the users endpoint completely but allow the other parts of the REST API to keep working. You can change it to fit your needs.

https://developer.wordpress.org/reference/hooks/rest_endpoints/