WordPress XML-RPC Interface Enabled
xmlrpc.php is enabled, giving bots a brute-force amplifier (system.multicall) and a pingback abuse surface.
What is WordPress XML-RPC Interface Enabled?
XML-RPC is WordPress' legacy API endpoint (xmlrpc.php) that once powered remote publishing and the Jetpack connection. Two of its methods make it a liability today. system.multicall lets a single HTTP request bundle up to hundreds of method calls — so a bot can submit thousands of username/password pairs in a handful of requests, bypassing login rate limits that only count requests. pingback.ping lets the endpoint notify (and effectively request) arbitrary URLs, which has been abused for DDoS reflection and for probing internal networks from your server. The modern REST API replaced every legitimate publishing use case, and Jetpack works fine with XML-RPC restricted.
Why It Matters to Your Business
With system.multicall, an attacker gets a bulk brute-force amplifier that most naive rate limiting cannot see (each request carries hundreds of credential tests). Successful credential testing means admin access: malicious plugins, SEO spam injection, defacement, or silent backdoors. Pingback abuse makes your server an unwilling participant in DDoS attacks — which tends to get your IP range flagged by protective services.
How to Fix It
Disable XML-RPC unless a specific plugin explicitly documents needing it:
Nginx (best - blocks before PHP runs):
location = /xmlrpc.php { deny all; return 404; }
Apache (.htaccess):
<Files xmlrpc.php>
Require all denied
</Files>
Cloudflare (WAF custom rule): block http.request.uri.path eq "/xmlrpc.php"
Security plugins: Wordfence / iThemes have a toggle — verify with an external request after enabling.
If Jetpack is installed: test after blocking; current versions do not require XML-RPC. If a legacy tool complains, allowlist its IP instead of re-enabling for everyone.
Verify: curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' https://yoursite.com/xmlrpc.php must return 404, not an XML response.
Frequently Asked Questions
Do I need XML-RPC on a modern WordPress site?
Almost never. The REST API (introduced in 2015) covers remote publishing and app integration, and current Jetpack versions work without XML-RPC. Unless a specific plugin documents a hard dependency, blocking it loses nothing.
What is the system.multicall brute-force problem?
system.multicall bundles up to hundreds of wp.getUsersBlogs calls (each with a username/password pair) into ONE HTTP request. Rate limits that count requests see one request; the attacker actually tested 200 passwords. That is why per-request throttling alone does not stop XML-RPC attacks.
How do I check if XML-RPC is enabled on my site?
Run a free scan on this page, or curl your /xmlrpc.php with a system.listMethods request — an XML method list means it is live; 404/403 means it is disabled.
Technical Classification
| OWASP Category | A05:2021 — Security Misconfiguration |
| CWE ID | CWE-284: Improper Access Control |
| Detected By | wp_xmlrpc, wordpress_deep, wpscan scanner(s) |
| Severity Level | medium |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our wp_xmlrpc, wordpress_deep, wpscan scanner checks for this issue automatically.
Scan My Website FreeRelated Vulnerabilities
Outdated CMS Version
The CMS (WordPress, Joomla, Drupal) is running an outdated version with known security vulnerabilities.
Vulnerable JavaScript Library
The site uses an outdated JavaScript library (jQuery, Lodash, Bootstrap, Angular) with known vulnerabilities.
Default CMS Install Page Exposed
The CMS installer (install.php, setup wizard) is still reachable, letting anyone re-run it and take over the site.
WordPress readme.html File Exposed
The default readme.html discloses your exact WordPress version, handing attackers a targeted exploit list.