WordPress is great and so are the endless themes around the internet you can use to display your blog to whatever you may feel like today.
But today I found out that those innocent themes (after all they are just a bunch of templates, .php files actually, so not really harmless anyway) can steal your login information, or that’s at least what it looks like after my “crime scene investigation”.
I am using the wordpress iphone app to take a photo, enter some words and then it posts the blog for me. It uses the xml-rpc interface to conveniently post your blog from your iphone to the wordpress code on your website.
It was only after something was not working, that I dug deeper to find out what was wrong. Actually this iphone app was working well on 3 blogs that I update once in a while, but not on one blog and I could not find anything wrong with it at first (same version, xml rpc was activated, etc.), only difference were the domainname and the way they look, the theme. Then I found this line in the source code (in the header.php file):
<link rel=”EditURI” type=”application/rsd+xml” title=”RSD” href=”http://scott-m.net/xmlrpc.php?rsd” />
A little bit further down that same header.php file was a line with the correct xml-rpc URL, but as the above line was closer to the beginning, the iphone app was fooled to take that first one when trying to figure out where my xml-rpc interface was located. But because that domain scott-m.net looks like it is not active anymore it triggers an error.
It does not look hard to set it up as a phishing trap by that friendly theme creator (who is so nice to give away that eye candy for free!). If they set up their own xml-rpc service that works like a proxy, so it may look like it is working well, but your username and password that are sent along can be easily saved to do some bad stuff. Or in my case, it may look like an error, but the username and password are already saved.
I am not saying that the above corvette template is phishing my userdetails on purpose (it could just be a line remaining from testing), but they could if they wanted.
I think it could be fixed by WordPress by checking if that EditURI href URL differs from the URL that you enter when setting up the domain in the iphone app. Maybe with an override of some sort, but in any case some protection against this would in imho be a lot safer than it is right now.