A Look at the New WordPress Brute Force Amplification Attack

This post details a new WordPress brute force amplification attack vector that abuses the `system.multicall` functionality within XML-RPC to make a large number of login attempts with a single HTTP request. It explains the underlying XML-RPC protocol and how `system.multicall` can be exploited. Cloudflare's Web Application Firewall (WAF) is presented as a solution, with a specific rule (WP0018) available for Pro+ customers to block these amplified brute force attempts. A manual mitigation by disabling `system.multicall` in WordPress's `functions.php` is also provided.