Exposed Angular panel and WordPress user enumeration enabled brute-force access to scooter operator backend

Enumeration of electricscootercompany.com.br subdomains located the production Angular panel and the api backend. Static bundle analysis revealed endpoints for trip activation, IoT device commands, and geofence management. WordPress REST API at /wp-json/wp/v2/users returned the slug electricscootercompany, which the panel login treated as a valid identity and differentiated error messages for nonexistent accounts versus invalid passwords. No rate limiting was present on the auth endpoint. The same pattern appears in prior micromobility incidents. A 2021 audit of Bird scooters documented unauthenticated MQTT topics that allowed remote unlock commands. A 2023 disclosure on Lime's operator tools showed similar subdomain exposure of Angular admin bundles. In both cases, initial access originated from public asset discovery rather than sophisticated exploits. Operational impact centers on physical vehicle control. An attacker with panel access can issue activation calls directly, bypassing the mobile app flow and payment validation. Fleet operators lose the ability to attribute unlocks to specific user sessions, complicating incident response and liability assignment. No evidence of patching or monitoring changes has appeared in subsequent scans of comparable Brazilian micromobility deployments.