WordPress XML-RPC: The 2.3.3 Security Flaw and How to Disable It Today

WordPress XML-RPC is the old remote publishing interface behind the xmlrpc.php file in every WordPress install. In February 2008 a flaw in it forced an urgent WordPress 2.3.3 security release. This article explains what happened then, why xmlrpc.php is still a common attack target, and how to check whether you need it or should switch it off.

Quick answer: XML-RPC lets apps and services talk to your WordPress site through xmlrpc.php. Most modern tools use the REST API instead, so many sites can turn XML-RPC off. Keep WordPress updated, and if nothing you use needs XML-RPC, disable it with a plugin, a filter in your theme, or a block in your server settings.

The 2008 WordPress 2.3.3 XML-RPC flaw

In February 2008 the WordPress team announced WordPress 2.3.3 as an urgent security release. A specially crafted XML-RPC request could let any valid user edit posts of any other user on the same blog. That was a scary bug for multi-author blogs.

For people who only wanted the security fix, the team suggested downloading 2.3.3 and copying the new xmlrpc.php file over the old one. They also warned that the WP-Forum plugin had a vulnerability that was being actively exploited, and advised removing it until it was fixed.

When I replaced only xmlrpc.php, the WordPress update alert kept nagging me in the dashboard:

So I compared the releases and found the files that had changed since the last version. Replacing just these stopped the message without a full install:

• xmlrpc.php
• wp-admin/install-helper.php
• wp-includes/version.php
• wp-includes/gettext.php
• wp-includes/pluggable.php

Today you should never patch single files like this. Use the built-in one-click update or automatic background updates so every security fix is applied in full.

What is WordPress XML-RPC used for today?

XML-RPC was built so desktop editors, mobile apps and other services could post to your blog remotely. It also handles pingbacks and trackbacks. Since WordPress 4.7 the REST API does most of this work, and most modern apps and plugins use it instead.

Some older tools still depend on xmlrpc.php. Before you turn it off, check whether you use any of these:

• An old desktop blogging client or a very old mobile app that posts through XML-RPC.
• Plugins or services that connect to your site through XML-RPC (check each plugin’s documentation).
• Pingbacks, which many site owners turn off anyway because they mostly bring spam.

Why attackers target xmlrpc.php

Because xmlrpc.php accepts logins, bots use it for brute force password guessing, and pingbacks have been abused to send floods of requests to other sites. If you see heavy traffic to xmlrpc.php in your server logs, it is almost always bots. See our guide on how to stop a WordPress brute force attack for more steps.

How to disable WordPress XML-RPC

1. Use a plugin. The Disable XML-RPC plugin on WordPress.org turns it off as soon as you activate it, with no settings to change.
2. Add a filter. In a small custom plugin or your child theme’s functions.php, add add_filter( 'xmlrpc_enabled', '__return_false' );. According to the WordPress developer docs, this filter turns off the XML-RPC methods that need a login, but not pingbacks.
3. Block it at the server. To stop all requests to xmlrpc.php, block the file in your web server, host control panel or firewall. Ask your host if you are not sure how.

Whichever method you choose, test any app or service that posts to your site afterwards. Then work through our list of WordPress security steps and turn on automatic updates for plugins and themes.

FAQ

Should I disable XML-RPC in WordPress?

If no app, plugin or service you use needs it, yes, disabling it removes a common target for bots. If something stops working afterwards, turn it back on.

Does the WordPress mobile app need XML-RPC?

Check the app’s own help pages for your setup. Many modern apps and plugins use the REST API, but test after disabling XML-RPC to be sure.

Is xmlrpc.php a security risk?

The file itself is part of WordPress core and is patched with each update. The risk is that bots use it for password guessing, so strong passwords, updates and blocking unneeded access all help.

What was fixed in WordPress 2.3.3?

WordPress 2.3.3 fixed an XML-RPC flaw that let any logged-in user edit other users’ posts, plus a few minor bugs.