Resource Limitation: WordPress xmlrpc.php Exposed¶

Identifier: wordpress_xmlrpc_php_exposed

Scanner(s) Support¶

Description¶

The issue arises when the xmlrpc.php file is exposed and accessible without authentication, allowing attackers to abuse the XML-RPC interface. This can lead to brute-force login attempts, resource-intensive pingbacks, or denial-of- service attacks. Securing or disabling this endpoint is critical to prevent abuse.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  wordpress_xmlrpc_php_exposed:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.