You are here: Home / Blog / WordPress Security Warning: Pingback Vulnerability & Temporary Fix

WordPress Security Warning: Pingback Vulnerability & Temporary Fix

Last updated on December 19, 2012 by 42 Comments

WordPress Pingback VulnerabilityA WordPress pingback vulnerability has been reported that could put your site's security at risk for a distributed denial-of-service attack (DDoS) attack.

Many WordPress bloggers use pingbacks and trackbacks to get notifications when someone links to their posts. I am one that likes to use them as well. But unfortunately, this new pingback vulnerability puts all our WordPress sites at risk.

A big thanks goes out to Bogdan Calin at Acunetix for his article "WordPress Pingback Vulnerability" to alert the public. He stated somebody posted on Redit about a WordPress scanner that is taking advantage of this new WordPress vulnerability. And even if you disable trackbacks, the threat still exists.

Which version of WordPress is affected?

While reading through comments on Bogdan's article, it seems that even WordPress 3.5 is at risk. So it looks like all versions.

guly
actually in my overnight tests i found that a blog post where trackbacks are disabled isn’t vulnerable. disabling it worked as a fix for my test installation, of course YMMV.

Bogdan Calin
That’s not my experience. In my case it worked even if trackbacks were disabled. I’ve tested on WordPress 3.5.

Source: http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/#comment-33097

How do you protect your WordPress blog from this pingback vulnerability?

According to Bogdan, there is no current fix but it has been reported to WordPress and will probably be fixed soon. In the meantime, you can disable your pingbacks and trackbacks from your WordPress Dashboard as follows:

UPDATE: 12/29/2012

Thanks to Kimberly Castleberry for letting us know about a the new "Prevent XMLRPC" plugin by Nathan Briggs.

The plugin makes it easy for users so you don't have to rename the file (see below). Once the vulnerability is fixed or to turn Pingbacks and trackbacks back on, just deactivate and delete the plugin.

If you would like to still disable trackbacks manually, following the steps below:

  1. Settings > Discussion
  2. Uncheck "

Important! Then as a safety precaution, Acunetix suggests renaming your xmlrpc.php file to something else.

How to rename WordPress xmlrpc.php file

  1. Log-in to your hosting server via SFTP through Filezilla or your favorite FTP program. Or through your cPanel > File Manager.
  2. Open your home directory (usually public_html) or where your WordPress is installed. (Tip: This is where your wp-activate.php file exists.)
  3. Find the xmlrpc.php file and Right-click then rename the file.

Until there is a WordPress security patch, I strongly suggest you follow the steps above to protect all your WordPress sites from this pingback vulnerability.

Leave Your Feedback

Have questions or concerns? Please leave your comment below.

Be sure to share this article with friends and colleagues so we can all help keep our sites safe.

==>> Pssst… Did you attend the “How to Create Prospect & Profit Pulling Content in 20 Minutes or Less with Jeff Herring, a Webinar Hosted by Regina Smola?”

Wow! What an amazing webinar. We were pumping out content during this live event, it was action packed and we produced results! And you can too! Listen to the Replay Right Now!. (Hurry, it's free and only available till the end of the weekend.)

Filed Under: Blog, Bugs & Vulnerabilities Tagged With: , ,
About Regina Smola

Regina is a sought-after WordPress Security Expert, Speaker, Author and owner of WPSecurityLock.com. She has helped thousands of WordPress users tighten security on their WordPress sites and fixed hundreds of hacked WordPress blogs. Read More. Follow on Facebook, Google+, Twitter.

Comments

  1. Justin says:
    December 19, 2012 at 10:10 am

    Hi Regina,
    I turned off trackbacks and pings about six months ago. I did it because I was tired of spammers trying to get a trackback to my blog. Thanks for informing us WordPress users about this vulnerability.

    Take Care.
    My latest post..How to Deal With Unhappiness in Your LifeMy Profile

    Reply
  2. Cyndi says:
    December 19, 2012 at 10:58 am

    Hi Regina, I wonder if you have heard of this. I have one client that keeps getting random subscriber notices but yet we have settings to not allow subscriptions; deactivated all possible plugins that could be allowing it yet they still keep coming. No sign of "subscribers" anywhere on back end we get the notifications for.

    Reply
    • Regina Smola says:
      December 19, 2012 at 11:18 am

      Hi Cyndi,

      I would check a couple things. First look at the email notices and see if they are "spoofs" or actually coming from the blog. Then I would check the database through phpMyAdmin and look in the wp_users table for hidden users.

      Is it possible you are using a plugin such as Subscribe to Comments?

      Reply
  3. Steverob says:
    December 19, 2012 at 11:35 am

    Thanks for pointing this out - I'm no shakes as a website engineer but I did follow your line of argument so will go ahead and do that disabling!
    My latest post..Great Christmas Gift Ideas to fix Foggy Headlights!My Profile

    Reply
  4. Wayne Harriman says:
    December 19, 2012 at 11:57 am

    Thanks for this info, Regina! So, renaming the xmlrpc.php file will not affect any blog functionality, correct? And can we rename it again after a fix has been issued for this vulnerability, or can it stay renamed forever? Thanks again for all you do for us WP'ers!
    My latest post..Is Santa Claus Real?My Profile

    Reply
  5. Monica says:
    December 19, 2012 at 12:28 pm

    Thanks Regina for the update! I don't quite get the potential danger. OK, the sites are vulnerable, but what exactly could happen? Cheers!
    My latest post..La violencia de género más vigente y camuflada que nuncaMy Profile

    Reply
    • Regina Smola says:
      December 19, 2012 at 12:39 pm

      Hi Monica,

      Basically, attackers can contact a large number of blogs and ask them to do pingbacks on targeted URLs. All of these sites will attack the target URL, thereby doing a DDoS. For more details on this pingback vulnerability click here.

      A distributed denial of service attack (DDoS) occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. These systems are compromised by attackers using a variety of methods.
      Malware can carry DDoS attack mechanisms; one of the better-known examples of this was MyDoom. Its DoS mechanism was triggered on a specific date and time. This type of DDoS involved hardcoding the target IP address prior to release of the malware and no further interaction was necessary to launch the attack.
      A system may also be compromised with a trojan, allowing the attacker to download a zombie agent (or the trojan may contain one). Attackers can also break into systems using automated tools that exploit flaws in programs that listen for connections from remote hosts. This scenario primarily concerns systems acting as servers on the web.
      Source: http://en.wikipedia.org/wiki/Denial-of-service_attack#Distributed_attack

      Reply
  6. Peter says:
    December 19, 2012 at 3:15 pm

    I might have already got hacked as it won't allow me to change settings. Is there anything I can do now?
    My latest post..Private Pilot Oral and Flight ExamMy Profile

    Reply
  7. chrismccoy says:
    December 20, 2012 at 12:37 pm

    what about disabling xmlrpc?

    add_filter( 'xmlrpc_enabled', '__return_false' );

    Reply
    • Regina Smola says:
      December 20, 2012 at 12:41 pm

      Hi Chris,

      I suppose that could be an option, but this is a temporary fix. Some that do that may forget when it's fixed and want to enable them again. It's easiest to rename the file.

      Reply
  8. Barry van Someren says:
    December 21, 2012 at 2:30 am

    Hi,

    Alternatively you can also set a .htaccess file.
    You should already have one in the root of your WordPress site (for permalinks)

    Just add the following:

    Deny from all

    Reply
  9. Guy Merritt says:
    December 28, 2012 at 10:13 am

    I've got a lot of WordPress sites and, oddly, this is happening on some sites and not others (voluminous amounts of pingbacks). I've disabled pingbacks and trackbacks, and, renamed the file to which you referred. I'm an idiot - I know a tiny bit about php...not much at all. The design of WordPress is pretty elegant. I would presume that it doesn't include many superfluous files not critical to it's function. What does renaming, and thereby disabling (presumably), the file "xmlrpc.php" do to WordPress? And I'm curious to see if all of this stops these darned things. My inbox is ringin' off the hook with these pingback notifications.

    Reply
  10. Regina Smola says:
    December 29, 2012 at 8:34 am

    Just updated this post about a new plugin that totally disables XMLRPC, preventing the recent Pingback spam vulnerability - See Update Here
    My latest post..WordPress Security Warning: Pingback Vulnerability & Temporary FixMy Profile (dofollow)

    Reply
  11. Steve Johnson says:
    December 30, 2012 at 10:40 am

    To begin with, this isn't "new". The original trac ticket: http://core.trac.wordpress.org/ticket/4137 was opened SIX YEARS AGO. Ryan Boren, a WP core developer and Automattic employee, had this to say FOUR YEARS AGO: "There are so many ways to orchestrate a DDOS, I don't know if this is worth bothering with. If someone feels otherwise, re-open with a patch that works with WP_Http." In the last four years, no patches have been submitted or suggested.

    A knowledgeable script kiddie can do port scans of a host without using XMLRPC. This "vulnerability" is overblown. Don't look for a fix from the WP core team anytime soon. It's not very high on their radar, if at all.
    My latest post..How to find WordPress posts that have a featured imageMy Profile

    Reply
    • Regina Smola says:
      December 31, 2012 at 2:38 pm

      Hi Steve,

      Thanks for sharing your opinion. While this was opened 6 years ago, it needs to be re-visited again since the release of the new script at https://github.com/FireFart/WordpressPingbackPortScanner that can take easily advantage of it. That ticket has been reopened and severity changed from minor to normal and is awaiting review.

      Better to make people aware in the side of caution. I personally have disabled my trackbacks pending word from WordPress.

      Reply
      • Steve Johnson says:
        December 31, 2012 at 4:17 pm

        I have no desire to be argumentative, but that 'port scanner' is next to worthless. No reputable hosting company that I'm aware of exposes stray ports, and certainly none of the bigger ones - HostGator, BlueHost, GoDaddy, etc. - do. The only occasion where it MIGHT expose a security hole is if someone is running WP from their own home-based server and has neglected basic security - like a firewall. Of the several million+ WP installs facing the internet, I would be surprised if more than a handful are hosted on a vulnerable server setup. Finding those would be akin to looking for a needle a mountain-sized haystack.

        The ticket severity was changed to 'normal' by JoeBlow - anyone with a login to trac can make changes to a ticket. 'Awaiting review' just means that it's on the trac ticket waiting list, along with 1,585 others as of this moment.

        Andrew Nacin, lead WP developer said, in ticket 21509 from 5 months ago (http://core.trac.wordpress.org/ticket/21509), regarding the default enabling of XML-RPC, "...Security is no greater a concern than the rest of core.

        There is no longer a compelling reason to disable this by default. It's time we should remove the option entirely."

        Do you see wordpress.com turning off their XML-RPC?

        It is just my opinion, of course, but I think this snowball was started down the hill by someone wanting to see their name in lights.

        Trumpeting this thing as a security concern when it isn't is not a good thing to do, IMHO.
        My latest post..How to find WordPress posts that have a featured imageMy Profile

        Reply
        • Regina Smola says:
          December 31, 2012 at 4:51 pm

          You're entitled to your opinion and I appreciate that. However I don't agree that it is NOT a security concern. BTW, I wasn't the snowball ;)
          My latest post..WordPress 3.5 - Major UpgradeMy Profile (dofollow)

          Reply
          • Steve Johnson says:
            December 31, 2012 at 5:11 pm

            LOL - I know you weren't the snowball :)

            Maybe you can elaborate at some point as to why you think this is a security concern - it doesn't expose any WP install or hosting account to any intruders whatsoever. If server admins thought it was a problem, you can bet they'd be up in arms over this, but I haven't heard a peep.

            Anyway - Happy New Year! You run a useful site, that's why I stay on your list even though I may disagree at times ;-:

            Reply
  12. Shane Curtis says:
    January 10, 2013 at 6:42 pm

    Thanks a lot for this article about how to have a strong WP security this is really great. Hackers hard to manage this. By the way I learn a lot and thanks a lot.

    Reply
  13. Ranjan says:
    January 15, 2013 at 4:45 am

    Hi Regina, its always nightmare for us, and I am little bit timid about my WordPress website even I kept backup and that's the reason why i certainly not updating my WordPress blog to 3.5, because sometime there are spying eyes around our websites also who are in search of tiny fault to invoke their legs.
    My latest post..Ways You Can Make Money As a PsychicMy Profile

    Reply
  14. Keith Davis says:
    January 15, 2013 at 7:24 am

    Thanks for the heads up Regina and the link to the plugin.

    Thanks to Kimberly Castleberry for letting us know about a the new "Prevent XMLRPC" plugin by Nathan Briggs.

    Looks as though I'm going to be busy tonight.

    BTW - lots of security info here, just subscribed.
    My latest post..Genesis WordPress theme framework version 1.9 – a box of delightsMy Profile

    Reply
  15. Iteire Apollos says:
    January 17, 2013 at 9:20 pm

    Wao! no more ping back and track back for now. I'm really going to miss that service. I hope something is done as soon as possible.
    My latest post..Guest Blogging Made EasyMy Profile

    Reply
  16. Sawicka says:
    January 22, 2013 at 7:38 am

    Well, I didn't turned off trackback and and pingback yet. Is it really risky to let it turned on these days? is it fine if I let it turned on? because I saw there is not much trackbacks and pingbacks on my website. Thans for answer my question Regina :)

    Regards,

    Sawicka
    My latest post..Gdzie kupic Vimax Pills Online – Vimax Pigułki Powiększania Penisa?My Profile

    Reply
  17. Geetu R Vaswani says:
    January 27, 2013 at 1:53 am

    You are doing a great service to us folks who use WordPress. Thank you.
    My latest post..Use Wuala to store encrypted dataMy Profile

    Reply
  18. April says:
    May 2, 2013 at 6:00 am

    Hi Regina,
    I followed the instruction, given above, in regards to the renaming of xmlrpc.php, but I ended up seeing the whole public_html directory being empty. I renamed it as 'xmlrpcc.php and saved it. Now, my website indicates as I enter the domain name, 'Forbidden You don't have permission to access / on this server.
    Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.' Could you give me some possibilities you can think of why this happened.. and how I could find the file and set the directory, just as before. Thanks for your input, Regina!

    Reply

Speak Your Mind

*

CommentLuv badge
Real Time Web Analytics