Question

During a black-box web assessment, you discover a WordPress site with /xmlrpc.php accessible and responding to POST requests. Standard login attempts against /wp-login.php are being rate-limited and account-locked after 5 failed tries. You want to test a list of 200 candidate credentials against several usernames while minimizing the number of HTTP requests and avoiding the login lockout controls. Which technique should you use?

Accepted Answer

Send system.multicall requests to xmlrpc.php, batching many wp.getUsersBlogs authentication attempts into a single HTTP request

Answer

Continue spraying /wp-login.php but rotate the X-Forwarded-For header on each request to evade the lockout counter

Answer

Use WPScan's --enumerate vp flag to identify vulnerable plugins and pivot to an authentication bypass CVE

Answer

Perform a deauthentication attack to force administrators to re-authenticate and capture the session cookie