XML-RPC API is enabled

What does this mean?

XML-RPC is an older WordPress feature used for remote publishing and "pingbacks." Most sites don't actually need it anymore, and it's frequently abused for the same brute-force login attempts as an exposed admin page, as well as to amplify denial-of-service attacks against other websites.

What are the potential impacts?

• XML-RPC is commonly abused to amplify brute-force login attempts, letting an attacker test hundreds of password combinations in a single request instead of one at a time, bypassing typical rate limiting.
• It's also a known vector for using your server, without your knowledge, as part of a distributed denial-of-service (DDoS) attack against a completely unrelated target — which can get your IP blacklisted through no fault of your own.