Via security@:
During a routine security assessment, I observed that the WordPress XML-RPC endpoint is accessible: URL: https://diff.wikimedia.org/xmlrpc.php Description: The XML-RPC interface is enabled and publicly accessible. While this is default behavior in WordPress, it has historically been leveraged for: - Brute force amplification attacks - Credential stuffing via multicall methods - Distributed denial-of-service reflection - Enumeration of enabled methods Impact: If not required for operational purposes, leaving XML-RPC enabled may increase the attack surface. Recommendation: - Disable XML-RPC if not actively used - Alternatively restrict access via: • Web server rules • WAF policy • Application firewall filtering - Implement rate limiting on authentication endpoints This message is shared in good faith for security awareness purposes.
It's forbidden via GET but can be accessed via POST. We should disable the page or block it via .htaccess et al, as a best practice.