Unauthenticated administrator takeover via username disclosure and XML-RPC multicall

Summary

A username-disclosure path and unbounded XML-RPC multicall can be combined into a low-noise password-guessing channel against known privileged WordPress accounts. Reaching administrator access and arbitrary PHP execution is conditional on a successful password guess and the site configuration; the supplied chain does not establish universal compromise.

Affected Products

WordPress core. The readable chain package documents the component behavior against WordPress 7.0.3. The August 12 disclosure email states revalidation against WordPress 7.0.4, but the readable chain artifact does not include a complete 7.0.4 trace.

Affected Scope

Product

WordPress

Component

XML-RPC user enumeration and system.multicall authentication batching

Affected function

WP_XMLRPC_Server::wp_getAuthors(); IXR_Server::multiCall(); wp.getUsersBlogs authentication path

Affected versions

WordPress 7.0.3 per the readable chain package; August 12 disclosure states 7.0.4 revalidation, not independently traceable from that artifact

Safe version

Not established in the supplied chain artifact

CWE

CWE-200; CWE-307

Technical Summary

Known privileged usernames disclosed through XML-RPC can be paired with unbounded system.multicall authentication attempts. The resulting administrator takeover and RCE path is conditional on password success and deployment permissions.

Prerequisites and Permissions

The XML-RPC endpoint and the relevant methods must be enabled. Username enumeration requires the capability stated in the component report (edit_posts for wp.getAuthors) or an exposed users endpoint; multicall requires a reachable XML-RPC endpoint. A successful password guess and administrator-level PHP execution path are not assumed.

Affected Locations

wp-includes/class-wp-xmlrpc-server.php:3318 — WP_XMLRPC_Server::wp_getAuthors(); edit_posts gate and user_login output. wp-includes/IXR/class-IXR-server.php:197 — IXR_Server::multiCall(); iterates methodcalls and invokes each embedded method. wp-includes/class-wp-xmlrpc-server.php:714 — wp_getUsersBlogs authentication method used in the batched attempts. Inputs: XML-RPC wp.getAuthors, system.multicall, and embedded wp.getUsersBlogs username/password pairs.

Reproducible Proof

Bounded proof from the supplied report: a Contributor/Author-level wp.getAuthors request returned user_login values including an administrator; one HTTP request containing four wp.getUsersBlogs guesses returned four independent authentication results. The report states that batch size scales to thousands, but no successful credential guess or administrator takeover is asserted here. Full password-spraying automation and post-login execution steps are withheld.

Vulnerable Code

class="tok-string">```php
foreach ( $methodcalls as $call ) {
    $method = $call[&class="tok-comment">#39;methodName'];
    $params = $call[&class="tok-comment">#39;params'];
    if ( $method == &class="tok-comment">#39;system.multicall' ) {
        $result = new IXR_Error(-32600, &class="tok-comment">#39;Recursive calls to system.multicall are forbidden');
    } else {
        $result = $this->call( $method, $params );
    }
}
class="tok-string">```

class="tok-string">```php
foreach ( get_users( array( &class="tok-comment">#39;fieldsclass="tok-string">' => array( 'IDclass="tok-string">', 'user_loginclass="tok-string">', 'display_name' ) ) ) as $user ) {
    $authors[] = array(
        &class="tok-comment">#39;user_id' => $user->ID,
        &class="tok-comment">#39;user_login' => $user->user_login,
        &class="tok-comment">#39;display_name' => $user->display_name,
    );
}
class="tok-string">```

Severity

high

Technical Analysis

The first component exposes account identifiers. The supplied report quotes WP_XMLRPC_Server::wp_getAuthors() as checking only edit_posts and then returning user_login for every account, without a role filter. The second component is the XML-RPC dispatcher: system.multicall iterates the supplied calls and invokes each embedded method independently. The report states that wp.getUsersBlogs attempts inside one multicall receive separate authentication results, while request-counting defenses see only one HTTP request. The chain therefore combines username discovery with authentication-attempt amplification; a successful password guess and subsequent admin capabilities are prerequisites for any PHP execution outcome.

Impact

Confidentiality: Medium to High, because exact login usernames and potentially pre-authentication account targeting are disclosed; broader site compromise is conditional. Integrity: Not demonstrated in the supplied chain; arbitrary PHP execution occurs only after a successful administrator login and applicable editor/upload capabilities. Availability: Not demonstrated. Password strength, lockout behavior, XML-RPC exposure, and deployment configuration materially affect exploitability.

Remediation

Do not return user_login to non-administrative callers; return only identifiers intended for public author attribution and apply a real role/capability scope. Limit system.multicall size, count every embedded authentication attempt toward lockout and rate limiting, and disable XML-RPC authentication or the unnecessary methods where not required. Add tests proving that a batch cannot evade per-account throttling and that administrator login identifiers are not exposed.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Aria Akhavan / Haikhavan Security