XML-RPC is a legacy remote procedure call interface used by WordPress for compatibility and remote management tasks. It lets external clients submit structured requests to the site, which can support functions such as remote publishing, app integrations, and certain maintenance workflows. Because it is older than newer API patterns, it often remains enabled for backward compatibility.
From a security perspective, XML-RPC matters because it can expose a large and persistent attack surface. Attackers have used it for password-guessing automation, traffic amplification, and probing for methods that should be restricted by permissions. Defenders often reduce risk by disabling XML-RPC when it is not needed, rate limiting requests, enforcing strong authentication, and reviewing logs for unusual remote access patterns. In practice, XML-RPC is a reminder that legacy interfaces can stay valuable to users while also becoming attractive targets if they are not tightly controlled.