{"id":2812,"date":"2008-02-05T12:19:04","date_gmt":"2008-02-05T06:49:04","guid":{"rendered":"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/"},"modified":"2026-10-15T14:04:24","modified_gmt":"2026-10-15T08:34:24","slug":"wordpress-233-urgent-security-release-for-xml-rpc-flaw","status":"publish","type":"post","link":"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/","title":{"rendered":"WordPress XML-RPC: The 2.3.3 Security Flaw and How to Disable It Today"},"content":{"rendered":"<p><strong>WordPress XML-RPC<\/strong> is the old remote publishing interface behind the xmlrpc.php file in every WordPress install. In February 2008 a flaw in it forced an urgent WordPress 2.3.3 security release. This article explains what happened then, why xmlrpc.php is still a common attack target, and how to check whether you need it or should switch it off.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-67178\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-xml-rpc-2026-1024x538.webp\" alt=\"WordPress XML-RPC security and how to disable it\" width=\"1024\" height=\"538\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-xml-rpc-2026-1024x538.webp 1024w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-xml-rpc-2026-300x158.webp 300w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-xml-rpc-2026-150x79.webp 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-xml-rpc-2026-768x403.webp 768w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-xml-rpc-2026.webp 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p><strong>Quick answer:<\/strong> XML-RPC lets apps and services talk to your WordPress site through xmlrpc.php. Most modern tools use the REST API instead, so many sites can turn XML-RPC off. Keep WordPress updated, and if nothing you use needs XML-RPC, disable it with a plugin, a filter in your theme, or a block in your server settings.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ae25d52828df\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"ez-toc-cssicon\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #1a202c;color:#1a202c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #1a202c;color:#1a202c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ae25d52828df\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#The_2008_WordPress_233_XML-RPC_flaw\" >The 2008 WordPress 2.3.3 XML-RPC flaw<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#What_is_WordPress_XML-RPC_used_for_today\" >What is WordPress XML-RPC used for today?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#Why_attackers_target_xmlrpcphp\" >Why attackers target xmlrpc.php<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#How_to_disable_WordPress_XML-RPC\" >How to disable WordPress XML-RPC<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#Should_I_disable_XML-RPC_in_WordPress\" >Should I disable XML-RPC in WordPress?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#Does_the_WordPress_mobile_app_need_XML-RPC\" >Does the WordPress mobile app need XML-RPC?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#Is_xmlrpcphp_a_security_risk\" >Is xmlrpc.php a security risk?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2008\/02\/wordpress-233-urgent-security-release-for-xml-rpc-flaw\/#What_was_fixed_in_WordPress_233\" >What was fixed in WordPress 2.3.3?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"The_2008_WordPress_233_XML-RPC_flaw\"><\/span>The 2008 WordPress 2.3.3 XML-RPC flaw<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>In February 2008 the WordPress team <a href=\"https:\/\/wordpress.org\/news\/2008\/02\/wordpress-233\/\" target=\"_blank\" rel=\"noopener\">announced WordPress 2.3.3<\/a> as an urgent security release. A specially crafted XML-RPC request could let <strong>any valid user edit posts of any other user<\/strong> on the same blog. That was a scary bug for multi-author blogs.<\/p>\n<p>For people who only wanted the security fix, the team suggested downloading 2.3.3 and copying the new xmlrpc.php file over the old one. They also warned that the WP-Forum plugin had a vulnerability that was being actively exploited, and advised removing it until it was fixed.<\/p>\n<p>When I replaced only xmlrpc.php, the WordPress update alert kept nagging me in the dashboard:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-2813\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/wordpress-update.gif\" alt=\"WordPress dashboard update notice\" width=\"365\" height=\"20\" \/><\/p>\n<p>So I compared the releases and found the files that had changed since the last version. Replacing just these stopped the message without a full install:<\/p>\n<ul>\n<li>xmlrpc.php<\/li>\n<li>wp-admin\/install-helper.php<\/li>\n<li>wp-includes\/version.php<\/li>\n<li>wp-includes\/gettext.php<\/li>\n<li>wp-includes\/pluggable.php<\/li>\n<\/ul>\n<p>Today you should never patch single files like this. Use the built-in one-click update or automatic background updates so every security fix is applied in full.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_is_WordPress_XML-RPC_used_for_today\"><\/span>What is WordPress XML-RPC used for today?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>XML-RPC was built so desktop editors, mobile apps and other services could post to your blog remotely. It also handles pingbacks and trackbacks. Since WordPress 4.7 the REST API does most of this work, and most modern apps and plugins use it instead.<\/p>\n<p>Some older tools still depend on xmlrpc.php. Before you turn it off, check whether you use any of these:<\/p>\n<ul>\n<li>An old desktop blogging client or a very old mobile app that posts through XML-RPC.<\/li>\n<li>Plugins or services that connect to your site through XML-RPC (check each plugin&#8217;s documentation).<\/li>\n<li>Pingbacks, which many site owners turn off anyway because they mostly bring spam.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Why_attackers_target_xmlrpcphp\"><\/span>Why attackers target xmlrpc.php<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Because xmlrpc.php accepts logins, bots use it for brute force password guessing, and pingbacks have been abused to send floods of requests to other sites. If you see heavy traffic to xmlrpc.php in your server logs, it is almost always bots. See our guide on how to <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2013\/04\/global-brute-force-attack-on-wordpress-blogs\/\">stop a WordPress brute force attack<\/a> for more steps.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_to_disable_WordPress_XML-RPC\"><\/span>How to disable WordPress XML-RPC<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ol>\n<li><strong>Use a plugin.<\/strong> The <a href=\"https:\/\/wordpress.org\/plugins\/disable-xml-rpc\/\" target=\"_blank\" rel=\"noopener\">Disable XML-RPC<\/a> plugin on WordPress.org turns it off as soon as you activate it, with no settings to change.<\/li>\n<li><strong>Add a filter.<\/strong> In a small custom plugin or your child theme&#8217;s functions.php, add <code>add_filter( 'xmlrpc_enabled', '__return_false' );<\/code>. According to the WordPress developer docs, this filter turns off the XML-RPC methods that need a login, but not pingbacks.<\/li>\n<li><strong>Block it at the server.<\/strong> To stop all requests to xmlrpc.php, block the file in your web server, host control panel or firewall. Ask your host if you are not sure how.<\/li>\n<\/ol>\n<p>Whichever method you choose, test any app or service that posts to your site afterwards. Then work through our list of <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/\">WordPress security steps<\/a> and turn on <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2020\/05\/auto-update-wordpress-plugins-themes\/\">automatic updates for plugins and themes<\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Should_I_disable_XML-RPC_in_WordPress\"><\/span>Should I disable XML-RPC in WordPress?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If no app, plugin or service you use needs it, yes, disabling it removes a common target for bots. If something stops working afterwards, turn it back on.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Does_the_WordPress_mobile_app_need_XML-RPC\"><\/span>Does the WordPress mobile app need XML-RPC?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Check the app&#8217;s own help pages for your setup. Many modern apps and plugins use the REST API, but test after disabling XML-RPC to be sure.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Is_xmlrpcphp_a_security_risk\"><\/span>Is xmlrpc.php a security risk?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The file itself is part of WordPress core and is patched with each update. The risk is that bots use it for password guessing, so strong passwords, updates and blocking unneeded access all help.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"What_was_fixed_in_WordPress_233\"><\/span>What was fixed in WordPress 2.3.3?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>WordPress 2.3.3 fixed an XML-RPC flaw that let any logged-in user edit other users&#8217; posts, plus a few minor bugs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress XML-RPC is the old remote publishing interface behind the xmlrpc.php file in every WordPress install. In February 2008 a&#8230;<\/p>\n","protected":false},"author":4,"featured_media":67178,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[6,7],"tags":[17],"class_list":["post-2812","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogging","category-security","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/2812","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/comments?post=2812"}],"version-history":[{"count":1,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/2812\/revisions"}],"predecessor-version":[{"id":67180,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/2812\/revisions\/67180"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media\/67178"}],"wp:attachment":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media?parent=2812"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/categories?post=2812"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/tags?post=2812"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}