Hi Hackerones Team, After previewing my target scopes and restrictions, I detremined to choese myscope " https://nextcloud.com " and started my testing phases. 1->> – XML-RPC is a feature of WordPress that enables data to be transmitted, with HTTP acting as the ‘transport mechanism’ and XML as the ‘encoding mechanism’. Basically it is an Application Programming Interface that allows developers to communicate with the website remotely using any kind of gadgets for ex: Developers can upload, modify, delete or update website contents using there mobile device if they are not carrying laptop with them. – WordPress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. The website https://nextcloud.com/xmlrpc.php/ has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. 2->> The wp-cron.php file is responsible for scheduled events in a WordPress website. By default, when a request is made, WordPress will generate an additional request from it to the wp-cron.php file. By generating a large number of requests to the website, it is therefore possible to make the site perform a DoS attack on itself. I found this vulnerability at https://nextcloud.com/wp-cron.php endpoint 3->> In order to determine whether the …Read More