WP 搭建的外贸站 CMS， Discord Bot 每天访问 xmlrpc. PHP 的作用是什么？今天检测日志发现 Discord Bot 每天都访问这个文件，听说这文件有漏洞被我删除了导致每天都有几条这个文件的 404 错误

[edis0n0]

[jlmzzz]

WordPress XML-RPC Pingback Vulnerability

Threat

XML-RPC in WordPress is an API which allows developers who make third party application and services the ability to interact to your WordPress site using
features like Trackbacks and Pingbacks.
The Pingback feature of XML-RPC API allows attacks like DDOS and Server-Side Request Forgery (SSRF) either against the server hosting WordPress or
against a target server.
QID Detection Logic:
This detection sends a POST request with XML data with invalid URL to verify the presence of vulnerability.

Impact

On Successful exploitation, an attacker can control a WordPress site to conduct DDOS or Server-Side Request Forgery (SSRF) attack against a target server.

Solution

Remove "pingback.ping" method from XML-RPC.

[00chang]

The xmlrpc.php file is a critical part of the WordPress CMS system, which is responsible for handling remote API requests. However, it has been found that the Pingback feature in XML-RPC API has a vulnerability that allows attackers to conduct DDOS or Server-Side Request Forgery (SSRF) attacks.

Therefore, it's essential to ensure that the Pingback feature is disabled on the WordPress site by removing the "pingback.ping" method from XML-RPC to minimize the risk of attacks. It's also recommended to keep the WordPress site and all plugins and themes up-to-date to stay protected from known vulnerabilities.


chatgpt 的回复

[janus77]

楼上太吓人了

[guxin0123]

建议装一个 wordfence 插件， 按照提示仔细检查一下