Let's look at the specific vulnerabilities in more detail

[mouakter13]

The main reason why you should disable xmlrpc.php on your WordPress site is because it introduces security vulnerabilities and can be the target of attacks.

Now that XML-RPC is no longer needed to communicate outside of WordPress, there is no reason to keep it enabled. That's why it's wise to make your site more secure by disabling it.

If xmlrpc.php is a security liability and no longer does a job, why hasn't it been removed from WordPress entirely?

The reason for this is because one of the key features of WordPress czech republic phone number data will always be backwards compatibility. If you manage your site well , you'll know that it's essential to keep WordPress , as well as any plugins or

But there will always be website owners who are unwilling or unable to upgrade their WordPress version. If they are running a version older than the REST API, they will still need access to xmlrpc.php.


Info
Kinsta blocks XML-RPC by default. You can find more information in our FAQ . If you want to enable it for an application, please contact support .

DDoS Attacks via XML-RPC Pingbacks
One of the features that xmlrpc.php enabled was pingbacks and trackbacks. These are the notifications that appear in your site's comments when another blog or site links to your content.

The XML-RPC specification was what made this communication possible, but it has been superseded by the REST API (as we have already seen).

If XML-RPC is enabled on your site, a hacker could potentially mount a DDoS attack on your site by exploiting xmlrpc.php to send a large number of pingbacks to your site in a short period of time. This could overload your server and put your site out of action.