Is XML-RPC still a security risk?

yes it is a security risk. Should it be disabled? most likely. Is it a OMG BBQ type of emergency? no.

If you have strong passwords for your accounts, it is not more of a security risk than the login form. It is a pointless security risk in the sense that it provides an additional attack vector and it code is probably not well maintained.

Related Posts:

  1. WordPress as XML-RPC client?
  2. How to enable wpautop for XMLRPC content
  3. Extending xml rpc – best practice
  4. How do I know if my site is using the xmlrpc.php file?
  5. XML-RPC: Add category to post data
  6. How Enable XML-RPC in WP 4.8.2
  7. XMLRPC and Underscored custom fields
  8. Creating post content from external web scraper via JSON or RPC
  9. wp.getUsers XML-RPC method is returning only 50 users, how can i get all the users
  10. xmlrpc.php Returning 405 Response Code
  11. Restrict access to xmlrpc.php
  12. Simply deleting XMLRPC file
  13. Storing an XML Response (Transient)?
  14. Problem with Create Post using metaWeblog.newPost or wp_insert_post
  15. Is it possible to change a blog’s theme through XML-RPC command? (and if so how?)
  16. How pull wordpress blog data using Blogger API using python
  17. Create a new post in wordpress with XML-RPC with the correct GUID?
  18. Working code example of PHP XML-RPC connex to site?
  19. Automated posting to wordpress from commandline or XMLRPC API on Dreamhost
  20. Posting via HTTP requests?
  21. Why is minimum_args protected?
  22. Multiple new posts using XML-RPC?
  23. Is it possible write, publish and edit posts with WordPress from console aka terminal?
  24. How to enable xmlrpc in WordPress 5?
  25. modify post meta data remotely without xmlrpc
  26. XMLRPC newPost post_content issue
  27. Can XMLRPC set show_on_front/page_on_front?
  28. Send an extra parameter with xml-rpc login?
  29. Is there any image size limit for wordpress xml-rpc?
  30. XML-RPC and $wpdb
  31. XMLRPC won’t connect?
  32. wp.setOptions of the XML-RPC API does not appear to work
  33. How to list updates using WordPress XML-RPC methods
  34. Get Post meta via XML-RPC using wp.getPost
  35. How to process shortcodes in XML-RPC
  36. “XML-RPC server accepts POST requests only” error message
  37. New post created with XML-RPC works fine but fails to assign category
  38. Tagging posts to custom taxonomies using XMLRPC in R
  39. Getting all posts from an XMLRPC request [duplicate]
  40. not well-formed (invalid token) at line 15, column 51, byte 720 when trying to parse XMLRPC call
  41. XML-RPC aplication blocked by the hosting
  42. Weblog clients cannot retrieve posts: An invalid hexadecimal character (0x7) was found in the element content of the document
  43. Using XML RPC to import data into WordPress
  44. Page content sent from XML RPC is corrupted
  45. metaWeblog.getRecentPosts is returning nothing in my iphone app
  46. tag is ignored when using xml-rpc
  47. How to read newpost return post ID value as integer for xmlrpc
  48. Enabling XML-RPC Accross 500 blogs
  49. Retrieve username and password from XMLRPC request
  50. Best way to eliminate xmlrpc.php?
  51. Does blocking xmlrpc.php affect pinging update services like pingomatic
  52. X-Pingback and XMLRPC
  53. PHP XMLRPC for WordPress: Adding meta tags and description
  54. Store source permalink on XMLRPC calls
  55. How to secure WordPress XMLRPC?
  56. XMLRPC Avoid duplicate content
  57. Possible to filter the posts or categories that XML-RPC users see in their mobile application?
  58. Removing unnecessary wordpress files
  59. Change post format using custom field
  60. How to disable XML-RPC from Linux command-line in a total way?
  61. PHP library that can merge stylesheet with inline style [closed]
  62. Is there a way to know if a post has been published through XML-RPC?
  63. Overwrite default XMLRPC function from plugin
  64. Is it possible to post with Word 2007 via XML-RPC and limit categories by user?
  65. Block only external access to wp-cron.php on OpenLiteSpeed
  66. XML-RPC and Custom Post Types
  67. Help Me Choose RSS or XML-RPC
  68. Turn off Admin Bar (Toolbar) in backend – no easy way
  69. Checking post format during xmlrpc_publish_post
  70. XML-RPC and post_date
  71. How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?
  72. XML-RPC errors they know my username?
  73. XML-RPC: How to add media caption to uploaded image?
  74. Getting trackpacks/pingbacks for a post via wordpress?
  75. Manipulating/view postmeta remotely
  76. XMLRPC slow and weird websites/services
  77. How to find a post using XML-RPC without knowing ID
  78. Multisite -> XMLRPC
  79. Remotely search WordPress sites using xml-rpc
  80. Call specific plugin update
  81. wp.getComments is returning nill, when i called from my iphone app [closed]
  82. How to edit feature image with XML RPC?
  83. Queries take 120+ seconds on my large WordPress site
  84. Checking for origin of a xmlrpc request
  85. Do I need to instantiate the XMLRPC class or any class in another class to access its methods?
  86. Using Microsift Word/Outlook for content publishing to WordPress
  87. Post via wp-admin and via iOS app, same hooks and triggers involved?
  88. Can I disable xml-rpc by setting it to false?
  89. Azure WordPress deny access to xmlrpc
  90. Regular XML-RPC timeouts
  91. XMLRPC pingback.extensions.getPingbacks not work with parameters
  92. API WordPress is Limited? Return False
  93. Why none of xmlrpc filters work
  94. Manage multiple wordpress installs (Best Practice)
  95. Anomaly with response coming from XML RPC Api get Post (integer out of range)
  96. Custom xmlrpc request does not pass parameters?
  97. Modifying WordPress XML-RPC Built-Ins
  98. Create a “feed” from one WordPress site to another?
  99. Getting the Posts’ permalinks from XLMRPC
  100. XMLRPC: How to retrieve possible custom fields for a new post?