Orb44 — WordPress example: not a shop, still exposed

Most WordPress sites are not stores — blogs, portfolios, small business pages. The same outside check finds real issues there too. Not a named site. Not a pentest.

What was open

The plugin version in readme.txt matched a public CVE. wp-json exposed the admin username. XML-RPC answered on the internet, a classic brute-force amplifier.

What changed

The owner updated the plugin, disabled XML-RPC, and rate-limited login attempts.

Not WooCommerce-only

Any WordPress site, shop or not, gets the same plugin, login, and exposure checks — this is not a checkout-specific product.