WordPress 5.3 Denial Of Service
Posted by deepcore on January 15, 2020 – 12:38 am
WordPress is vulnerable to denial of service by abusing XMLRPC API. The system.multicall function lets you batch other API calls. Another API function is pingback.ping, which makes WordPress make a connection out to another site. If you batch a few thousand pingback.ping requests using the multicall feature, you can exhaust a variety of different resources on the server. This PoC will eat through Apache2’s worker threads and will also make MySQL eat up more CPU and mem, possibly knocking over low-RAM VPS instances.
Post a reply
You must be logged in to post a comment.