And as for actual WordPress pingbacks .... you should probably switch 'em off

Patch adds warning label nobody reads

More than 26,000 WordPress sites have been enslaved and used in a recent distributed denial-of-service attack campaign using a vulnerability first described in March 2014."