Security Test: WordPress xmlrpc.php Exposed¶

Scanner(s) Support¶

Description¶

Default Severity: medium

The issue arises when the xmlrpc.php file is exposed and accessible without authentication, allowing attackers to abuse the XML-RPC interface. This can lead to brute-force login attempts, resource-intensive pingbacks, or denial-of-service attacks. Securing or disabling this endpoint is critical to prevent abuse.

Configuration¶

Identifier: information_disclosure/wordpress_xmlrpc_php_exposed

Examples¶

All configuration available:

checks:
  information_disclosure/wordpress_xmlrpc_php_exposed:
    skip: false # default

Compliance and Standards¶