From ce3d484e35646b53b366c3f59cdfb67b0c25202e Mon Sep 17 00:00:00 2001 From: Ari Stathopoulos Date: Tue, 16 Sep 2025 14:21:02 +0300 Subject: [PATCH 1/8] Add more bypass methods --- pp-disable-xml-rpc.php | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index 0a7e571..14d2020 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -17,4 +17,20 @@ * Text Domain: pp-disable-xml-rpc */ +// Disable XML-RPC using the 'xmlrpc_enabled' filter. add_filter( 'xmlrpc_enabled', '__return_false' ); + +// Add an empty class to bypass Core. +class pp_wp_xmlrpc_server { + public function serve_request() { return; } +} +add_filter( 'wp_xmlrpc_server_class', function() { + return 'pp_wp_xmlrpc_server'; +} ); + +// Bail early if XMLRPC_REQUEST is defined. +add_action( 'init', function() { + if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) { + die(); + } +} ); \ No newline at end of file From 671e737a5fc6e0761c765b33a51df097716e94e6 Mon Sep 17 00:00:00 2001 From: Ari Stathopoulos Date: Tue, 16 Sep 2025 14:27:53 +0300 Subject: [PATCH 2/8] Update pp-disable-xml-rpc.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- pp-disable-xml-rpc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index 14d2020..928077b 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -31,6 +31,6 @@ public function serve_request() { return; } // Bail early if XMLRPC_REQUEST is defined. add_action( 'init', function() { if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) { - die(); + wp_die( __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ), __( 'XML-RPC Disabled', 'pp-disable-xml-rpc' ), array( 'response' => 403 ) ); } } ); \ No newline at end of file From 34e8f27d63baccf337aeccd4156adda157601850 Mon Sep 17 00:00:00 2001 From: Ari Stathopoulos Date: Tue, 16 Sep 2025 14:29:13 +0300 Subject: [PATCH 3/8] WIP on add/bypass-methods --- pp-disable-xml-rpc.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index 928077b..3d4458d 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -31,6 +31,10 @@ public function serve_request() { return; } // Bail early if XMLRPC_REQUEST is defined. add_action( 'init', function() { if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) { - wp_die( __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ), __( 'XML-RPC Disabled', 'pp-disable-xml-rpc' ), array( 'response' => 403 ) ); + wp_die( + __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ), + __( 'XML-RPC Disabled', 'pp-disable-xml-rpc' ), + array( 'response' => 403 ) + ); } } ); \ No newline at end of file From e07a3b785b6d7a4404e415717020af327a7df1ec Mon Sep 17 00:00:00 2001 From: Filip Ilic Date: Tue, 16 Sep 2025 14:25:52 +0200 Subject: [PATCH 4/8] return error in XML format --- pp-disable-xml-rpc.php | 43 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 6 deletions(-) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index 3d4458d..deb1c56 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -17,12 +17,47 @@ * Text Domain: pp-disable-xml-rpc */ +/** + * Send XML-RPC fault response. + */ +if ( ! function_exists( 'pp_send_xmlrpc_fault' ) ) { + function pp_send_xmlrpc_fault() { + header( 'Content-Type: text/xml; charset=UTF-8' ); + header( 'HTTP/1.1 405 Method Not Allowed' ); + + $error_message = \esc_xml( __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ) ); + + echo << + + + + + + faultCode + 405 + + + faultString + {$error_message} + + + + + + XML; + exit; + } +} + // Disable XML-RPC using the 'xmlrpc_enabled' filter. add_filter( 'xmlrpc_enabled', '__return_false' ); // Add an empty class to bypass Core. class pp_wp_xmlrpc_server { - public function serve_request() { return; } + public function serve_request() { + pp_send_xmlrpc_fault(); + } } add_filter( 'wp_xmlrpc_server_class', function() { return 'pp_wp_xmlrpc_server'; @@ -31,10 +66,6 @@ public function serve_request() { return; } // Bail early if XMLRPC_REQUEST is defined. add_action( 'init', function() { if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) { - wp_die( - __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ), - __( 'XML-RPC Disabled', 'pp-disable-xml-rpc' ), - array( 'response' => 403 ) - ); + pp_send_xmlrpc_fault(); } } ); \ No newline at end of file From caf231399c9ade5a05d166fca424c98352e8a8be Mon Sep 17 00:00:00 2001 From: Ari Stathopoulos Date: Wed, 17 Sep 2025 07:33:02 +0300 Subject: [PATCH 5/8] Revert "return error in XML format" This reverts commit e07a3b785b6d7a4404e415717020af327a7df1ec. --- pp-disable-xml-rpc.php | 43 ++++++------------------------------------ 1 file changed, 6 insertions(+), 37 deletions(-) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index deb1c56..3d4458d 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -17,47 +17,12 @@ * Text Domain: pp-disable-xml-rpc */ -/** - * Send XML-RPC fault response. - */ -if ( ! function_exists( 'pp_send_xmlrpc_fault' ) ) { - function pp_send_xmlrpc_fault() { - header( 'Content-Type: text/xml; charset=UTF-8' ); - header( 'HTTP/1.1 405 Method Not Allowed' ); - - $error_message = \esc_xml( __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ) ); - - echo << - - - - - - faultCode - 405 - - - faultString - {$error_message} - - - - - - XML; - exit; - } -} - // Disable XML-RPC using the 'xmlrpc_enabled' filter. add_filter( 'xmlrpc_enabled', '__return_false' ); // Add an empty class to bypass Core. class pp_wp_xmlrpc_server { - public function serve_request() { - pp_send_xmlrpc_fault(); - } + public function serve_request() { return; } } add_filter( 'wp_xmlrpc_server_class', function() { return 'pp_wp_xmlrpc_server'; @@ -66,6 +31,10 @@ public function serve_request() { // Bail early if XMLRPC_REQUEST is defined. add_action( 'init', function() { if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) { - pp_send_xmlrpc_fault(); + wp_die( + __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ), + __( 'XML-RPC Disabled', 'pp-disable-xml-rpc' ), + array( 'response' => 403 ) + ); } } ); \ No newline at end of file From 4459b429e7749923dbe07eed175c145adda2dd9a Mon Sep 17 00:00:00 2001 From: Ari Stathopoulos Date: Wed, 17 Sep 2025 07:35:47 +0300 Subject: [PATCH 6/8] reuse die function --- pp-disable-xml-rpc.php | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index 3d4458d..ce4156a 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -20,21 +20,30 @@ // Disable XML-RPC using the 'xmlrpc_enabled' filter. add_filter( 'xmlrpc_enabled', '__return_false' ); +/** + * Die to prevent XMLRPC requests. + */ +function pp_disable_xml_rpc_die() { + wp_die( + __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ), + __( 'XML-RPC Disabled', 'pp-disable-xml-rpc' ), + array( 'response' => 403 ) + ); +} + // Add an empty class to bypass Core. class pp_wp_xmlrpc_server { - public function serve_request() { return; } + public function serve_request() { + pp_disable_xml_rpc_die(); + } } add_filter( 'wp_xmlrpc_server_class', function() { - return 'pp_wp_xmlrpc_server'; + return 'pp_wp_xmlrpc_server'; } ); // Bail early if XMLRPC_REQUEST is defined. add_action( 'init', function() { if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) { - wp_die( - __( 'XML-RPC services are disabled on this site.', 'pp-disable-xml-rpc' ), - __( 'XML-RPC Disabled', 'pp-disable-xml-rpc' ), - array( 'response' => 403 ) - ); + pp_disable_xml_rpc_die(); } } ); \ No newline at end of file From 56a764030bf3ff91a80641b55f72e9e8291e10cf Mon Sep 17 00:00:00 2001 From: Filip Ilic Date: Thu, 11 Dec 2025 09:59:51 +0100 Subject: [PATCH 7/8] Bump "Tested up to" version to 6.9 --- pp-disable-xml-rpc.php | 1 + 1 file changed, 1 insertion(+) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index ce4156a..0f70847 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -8,6 +8,7 @@ * Plugin URI: https://progressplanner.com * Description: A utility plugin to disable XML-RPC. * Requires at least: 6.6 + * Tested up to: 6.9 * Requires PHP: 7.4 * Version: 1.6.1 * Author: Team Emilia Projects From d4cbba8d1fc09290c0667edaed9396d75e8e6bcb Mon Sep 17 00:00:00 2001 From: Ari Stathopoulos Date: Thu, 11 Dec 2025 12:11:03 +0200 Subject: [PATCH 8/8] Apply suggestion from @aristath --- pp-disable-xml-rpc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pp-disable-xml-rpc.php b/pp-disable-xml-rpc.php index 0f70847..74ba94a 100644 --- a/pp-disable-xml-rpc.php +++ b/pp-disable-xml-rpc.php @@ -7,7 +7,7 @@ * Plugin name: Disable XML-RPC by Progress Planner * Plugin URI: https://progressplanner.com * Description: A utility plugin to disable XML-RPC. - * Requires at least: 6.6 + * Requires at least: 6.7 * Tested up to: 6.9 * Requires PHP: 7.4 * Version: 1.6.1