7

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the xmlrpc.php file that it is also recommended to remove wlwmanifest.xml (Windows Live Writer Manifest link).

So far as I can tell wlwmanifest.xml does not offer up any WordPress version information, nor does it seem able to be leveraged for testing username/password credentials as xmlrpc.php does.

Most of the content in the sources below states, in summary, "remove code if not using as it is unnecessary."

Can anyone shed some light as to why this file should also be removed/blocked? If this is not a security concern, is this just simply an optimization?

Thank you!

Sources (that suggest removal/block of wlwmanifest.xml):

4

There's no point in removing it. It's a static file with information on how Windows Live Writer can talk to wordpress.

Discovering that you're running wordpress is usually rather trivial, so nothing much is revealed by this file either.

When it comes to securing WP, focus on staying up to date, via automatic patching.

| improve this answer | |
  • The one link above suggests that by leaving it, someone could write a PHP header that includes it. What's the risk if that happens? – schroeder Apr 3 at 21:41
  • I would guess none. It's a static file. They could as well include it from a remote uri anyway – vidarlo Apr 3 at 21:49
  • It does show the admin url though... – stephen Apr 14 at 6:58
0

Some vulnerability scanning scripts check for the existence of this file in order to detect if Wordpress is installed. Thus having the file will draw more attention to your Wordpress install.

Assuming there is an as yet unknown vulnerability in your Wordpress or associated plugins, then having this file installed will draw attention to your wordpress installation.

Removing it makes it a tiny bit less likely that your wordpress install will be exploited.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.