Hi all,
We've yanked the feature. I've just released Wordfence 5.0.3 and the only difference is that we've completely removed the ability to disable XML-RPC.
I've also put up a blog entry here explaining what we're doing to prevent this from happening in future:
In short: We screwed up. We're sorry. Clearly our release process and quality assurance isn't keeping up with the growth in Wordfence's user base and the sites that depend on us. So we need to fix this internally and I can assure you we're going to improve the process.
Thanks to everyone including Andrew Nacin and all posters above who weighed in on this.
Regards,
Mark Maunder.