A Look at the New WordPress Brute Force Amplification Attack

What this post added

This post details a new WordPress brute force amplification attack vector that abuses the `system.multicall` functionality within XML-RPC to perform a large number of login attempts with a single HTTP request. It explains the XML-RPC protocol, the `system.multicall` abuse, and provides a Cloudflare WAF rule (WP0018) to mitigate this specific attack by checking for consistencies that line up with known malicious activities. A manual solution by disabling `system.multicall` in `functions.php` is also provided.