wp-config backups blocked but with 403 (should be 404)
readme.html exposed (200) - should be 404
most significant issue identified during this phase was the working user enumeration capability. multiple valid usernames were successfully enumerated through this method.
port scan + discovery
hit a brick wall with web-based enumeration, so went back to basics (NMAP)
from claude: XML-RPC (Extensible Markup Language Remote Procedure Call) is a legacy protocol that enables remote function calls using XML for encoding and HTTP as the transport mechanism. While XML-RPC provides various functionalities, this analysis focuses specifically on the system.multicall() method due to its security implications.
system.multicall() Attack Vector
the system.multicall() function allows multiple remote procedure calls to be batched into a single HTTP request. this can be abused to bypass rate limiting and intrusion detection systems
example: traditional brute-force attack: 100 password attempts = 100 individual HTTP requests, which triggers rate limiting and detection mechanisms
wpscan --url https://staging.<SITE>.com --enumerate u --plugins-detection passive --random-user-agent [+] XML-RPC seems to be enabled: https://staging.<SITE>.com/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ [+] WordPress readme found: https://staging.<SITE>.com/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: https://staging.<SITE>.com/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 6.7.4 identified (Outdated, released on 2025-09-30). | Found By: Rss Generator (Passive Detection) | - https://staging.<SITE>.com/feed/, <generator>https://wordpress.org/?v=6.7.4</generator> | - https://staging.<SITE>.com/comments/feed/, <generator>https://wordpress.org/?v=6.7.4</generator> [i] User(s) Identified: [+] <REDACTED> | Found By: Rss Generator (Passive Detection) | Confirmed By: Rss Generator (Aggressive Detection) [+] <REDACTED> | Found By: Wp Json Api (Aggressive Detection) | - https://staging.<SITE>.com/wp-json/wp/v2/users/?per_page=100&page=1 | Confirmed By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) [+] <REDACTED> | Found By: Wp Json Api (Aggressive Detection) | - https://staging.<SITE>.com/wp-json/wp/v2/users/?per_page=100&page=1 | Confirmed By: | Oembed API - Author URL (Aggressive Detection) | - https://staging.<SITE>.com/wp-json/oembed/1.0/embed?url=https://staging.<SITE>.com/&format=json | Yoast Seo Author Sitemap (Aggressive Detection) | - https://staging.<SITE>.com/author-sitemap.xml | Author Id Brute Forcing - Author Pattern (Aggressive Detection) [+] <REDACTED> | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) [+] <REDACTED> | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) ---
WPScan results confirmed:
four distinct user accounts were enumerated
xml-rpc functionality was verified as enabled (should have just done this from the start, in retrospect)
multiple enumeration vectors were available (RSS feeds, JSON API, Author sitemaps)
when combined with the system.multicall() amplification capability, this configuration presents a significant security risk for credential brute-force attacks.
disclosure
This vulnerability was responsibly disclosed to the affected organization and has been remediated. Public disclosure was authorized following the resolution of all identified security issues.
