Is WordPress XMLRPC a security problem?

What is WordPress XMLRPC?

WordPress XMLRPC allows other websites and software to interact with your WordPress website. Also known as an API. Some examples include creating new posts, adding comments, deleting pages and probably most commonly used in WordPress, pingbacks.

As the name suggests, XMLRPC works by sending and receiving XML data. In WordPress, the file responsible for XMLRPC is called xmlrpc.php. This is the file that will receive XML data, process it and return the response, also in XML.


Important changes to WPScan API subscription plans

API Subscription Plan Changes

We are making important changes to our subscription plans that we think you should know about.

From February 1st we will be making the following changes to the WPScan WordPress Vulnerability Database subscription plans:

  • Free plan: Lowering the API calls from 50 to 25.
  • Starter plan: Increasing the API calls from 50 to 75.
  • Professional plan: Increasing the API calls from 250 to 300.

We will not be changing any of our subscription plan pricing, we are only making changes to the number of API calls each plan can make.


WPScan authorized as a CVE Numbering Authority by the CVE Program

Bayonne, France, January 12th 2021, WordPress security company, WPScan, has announced that it has been named a Common Vulnerability and Exposures Numbering Authority authorized by the CVE Program to assign CVE IDs to vulnerabilities in Wordpress.

With 75 million users, WordPress is the most popular content management platform in the world and powers 39.6% of all websites, including the New York Times, Forbes, The White House and CNN. WordPress online retail platform, WooCommerce, is used by 27% of the ecommerce market.

Because it is the most popular CMS platform, WordPress also attracts the attention of cyber criminals. To help keep a third of the world’s websites protected against hackers, botnet operators and malware merchants, an international army of enthusiasts and cyber security experts constantly check for vulnerabilities that could be exploited. New vulnerabilities are assigned an identification number and added to the Common Vulnerability and Exposures (CVE) List, which is overseen by CVE Numbering Authorities (CNAs).


WordPress Security Roundup November 2020

It’s that time of year again where we donate 2% of our profits to a charity that positively impacts climate change, and this year we chose Sea Shepherd France again. We do this every year as part of our Hack the Planet pledge.

We launched several new versions of our WPScan WordPress security plugin, which now contains additional security checks, rather than just the API checks. This included the following checks:


November 2020 Monthly Vulnerability Roundup

WordPress Plugin Vulnerabilities


WordPress 5.5.2 Security Release

WordPress 5.5.2 was released on October 30th 2020, reportedly fixing 10 security vulnerabilities. Below are the vulnerabilities that were mentioned in the release notes and that have been added to the WPScan WordPress Vulnerability Database so far, including one from our very own security researcher, Erwan.More

September 2020 Monthly Vulnerability Roundup

WordPress Plugin Vulnerabilities


On December 1st 2020 we will be closing (the SaaS)

(We are not closing any of our other products or services, just the online SaaS!) started life in 2015 when we contracted a Rails development company to create a SaaS web front end on top of our WPScan CLI tool. Unfortunately, at that time, we only had the budget to complete around 50% of the work, as we were still a community project making hardly any money.

The project sat in this half finished state for three years, until 2018, when we had a little bit more money to hire a freelance Rails developer.