# CVE Assessment: WordPress XML-RPC (elitery.com)
**Target:** `https://43.230.29.247/xmlrpc.php` (Origin Server)  
**Status:** 80 methods active including `system.multicall`, `pingback.ping`

---

## 🎯 CVE Map — XML-RPC & Associated Plugins

### A. XML-RPC Core CVEs

| CVE / Vuln | CVSS | Affects | Applicable? | Detail |
|---|---|---|---|---|
| **XML-RPC DDoS Amplification** | 7.5 | WP < 5.3.x | ⚠️ **Possible** | `system.multicall` + `pingback.ping` = DDoS reflection. 80 methods confirmed active. |
| **CVE-2007-0540** (Pingback) | 5.0 | WP 1.x/2.0.x | ❌ Too old | SourceURI DoS — but only for ancient versions |
| **XML-RPC Credential Brute-force** | 7.5 | All WP | ✅ **Possible** | XML-RPC allows faster brute-force than wp-login (1 req = 100 passwords via multicall) |
| **WordPress < 5.3.x DoS** (#47800) | 7.8 | WP < 5.3 | ⚠️ Unknown | System.multicall confirmed working |

### B. Elementor Plugin CVEs (installed — version likely 3.26.x)

| CVE / Vuln | CVSS | Affects | Applicable? | Detail |
|---|---|---|---|---|
| **Elementor 3.6.2 RCE** (50882.py) | 8.8 | 3.6.0 - 3.6.2 | ❌ **Patched** | Needs authenticated user. Current v3.26.x has patched this. |
| **Elementor < 3.12.2 Stored XSS** (51956.py) | 6.4 | < 3.12.2 | ❌ **Patched** | Admin+ priv required. |
| **Elementor 3.5.5 Iframe Inj** (51716.txt) | 5.3 | 3.5.5 | ❌ **Patched** | |

### C. Jet Engine Plugin CVEs (v3.8.10.2)

| CVE / Vuln | CVSS | Affects | Detail |
|---|---|---|---|
| **Jet Engine v3.8.10.2** | — | Current version | ❌ No known public exploits in searchsploit. Crocoblock plugins are premium — CVEs usually disclosed privately. |

### D. Elementor Pro & Essential Addons

| CVE / Vuln | CVSS | Affects | Detail |
|---|---|---|---|
| **Essential Addons 2.6.9 Stored XSS** (52126.py) | 5.4 | 2.6.9 | ❌ Version unknown, likely patched |

### E. Apache 2.4.41 CVEs (70+ via Shodan)

| Notable CVE | CVSS | Type |
|---|---|---|
| CVE-2023-25690 | 9.8 | HTTP request smuggling |
| CVE-2024-38474-CVE-2024-38477 | 8.6 | HTTP/2 vulnerabilities |
| CVE-2021-41773/42013 | 7.5 | Path traversal (patched in 2.4.49+) |
| CVE-2022-26377 | 5.0 | mod_proxy |

---

## 🔴 XML-RPC Attack Vectors (Active)

### 1. DDoS Amplification via system.multicall
```
Method:  system.multicall + pingback.ping
Risk:    MEDIUM-HIGH
Vector: 1 request = 100+ pingback calls → server floods external target
Status:  ✅ system.multicall confirmed working
         ✅ pingback.ping listed in system.listMethods
         ❌ X-Pingback header NOT present (partial mitigation)
```

### 2. Credential Brute-force via XML-RPC
```
Method:  wp.getUsers (blocked), but system.multicall + wp.getPosts/wp.getComments
Risk:    MEDIUM
Note:    wp.getUsers returns 405 (blocked)
         Other auth methods may still accept brute-force
```

### 3. Apache CVE — HTTP Request Smuggling
```
CVE-2023-25690 (CVSS 9.8)
Vector: HTTP request smuggling → cache poisoning / WAF bypass
Note:   This is CRITICAL if unpatched in Apache 2.4.41
```

---

## ✅ Mitigations Present

| Mitigation | Status |
|---|---|
| Cloudflare WAF | ✅ Blocks xmlrpc from public |
| wp.getUsers blocked | ✅ 405 response |
| wp.getAuthors blocked | ✅ 405 response |
| X-Pingback header disabled | ✅ Not present |
| Yoast author redirect | ✅ Active |
| REST API authenticated-only | ✅ |
| Elementor on latest version | ✅ 3.26.x confirmed |

---

## ⚠️ Gaps / Unmitigated

| Gap | Risk |
|---|---|
| XML-RPC accessible via origin IP | 🔴 Direct access bypasses Cloudflare |
| system.multicall functional | 🟠 DDoS amplification potential |
| 70+ Apache CVEs on 2.4.41 | 🟠 CVE-2023-25690 (9.8) most critical |
| No rate limiting detected | 🟡 Brute-force possible via origin |

---

## 📌 Recommended Focus

```
Priority 1: CVE-2023-25690 (Apache HTTP Request Smuggling)
  → PoC: curl -H "Transfer-Encoding: chunked" ...
  → Impact: WAF bypass, cache poisoning

Priority 2: XML-RPC DDoS via system.multicall
  → PoC: multicall with 100+ pingback entries
  → Impact: Server resource exhaustion

Priority 3: XML-RPC Credential Brute-force
  → Via origin IP (bypasses Cloudflare)
  → Impact: WordPress admin access
```

**Note:** All active scanning required for CVE verification needs explicit authorization.