# MA-526.102015: MyCERT Advisory - Brute Force Amplification Attacks Against WordPress

**Date:** 12 Oct 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-526.102015  
**Advisory ID:** MA-526.102015

---

#### **1.0 Introduction**
Researchers from security firm Sucuri have found a way to perform Brute Force amplification attacks against WordPress' built-in **XML-RPC feature** to crack down administrator credentials. XML-RPC is one of the simplest protocols for securely exchanging data between computers across the Internet. It uses the **system.multicall** method that allows an application to execute multiple commands within one HTTP request.
**2.0 Impact**
These updates address exploitation of this vulnerability may allow a remote attacker to use **XML-RPC** protocol in conjunction with the **system.multicall** method that allows them to:
- Go undetected by normal brute-force mitigation products
- Try hundreds of thousands of username and password combinations with few XML-RPC requests.
**3.0 Affected Products**
The affected products are content management systems (CMS) which support XML-RPC such WordPress and Drupal.
**4.0 Recommendation**
MyCERT highly recommended users of these applications to refer how to Prevent Brute-Force Amplification Attack via XML-RPC and follow the best practices against brute force attack:
> 4.1 The XML-RPC protocol allows users to execute multiple methods within a single request by using the “system.multicall” method:
>
> - To protect against this threat, do block all access to XML-RPC.
>
> 4.2 If you are not using any plugin that uses the xmlrpc.php file:
>
> - Do rename/delete it.
> - But, if you are using plugins such as JetPack, blocking xmlrpc.php may result in some broken functionality on your website.
>
> 4.3 Webmasters could block XML-RPC system.multicall requests using a WAF (Web Application Firewall). This will protect you against the amplification methods.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#f3908a919681cacacab3908a91968180969086819a878add9e8a) or [[email protected]](/cdn-cgi/l/email-protection#3c51455f594e487c51455f594e4812534e5b125145) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Brute Force Amplification Attacks Against WordPress XMLRPC:
[https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html](https://www.us-cert.gov/ncas/current-activity/2015/09/21/Adobe-Releases-Security-Update-Flash-Player)
- WordPress Security: Brute Force Amplification Attacks Targeting Thousand of Blogs:
<http://thehackernews.com/2015/10/WordPress-BruteForce-Amplification.html>
- Brute-Force amplification attacks on WordPress rely on XML-RPC:
<http://itsecuritynews.info/2015/10/11/brute-force-amplification-attacks-on-wordpress-rely-on-xml-rpc-2/>