Index: wp-includes/class-wp-xmlrpc-server.php
===================================================================
--- wp-includes/class-wp-xmlrpc-server.php	(revision 38535)
+++ wp-includes/class-wp-xmlrpc-server.php	(working copy)
@@ -596,6 +596,14 @@
 	 *  - 'xmlrpc' - url of xmlrpc endpoint
 	 */
 	public function wp_getUsersBlogs( $args ) {
+
+		// Bail on XML with a missing param that causes IXR to treat params as a string instead of an array.
+		// Example: ...<params><param><value>someuser</value></param><param><value></value></param></params>...
+		if ( ! is_array( $args ) ) {
+			$this->error = new IXR_Error( 403, __( 'Incorrect username or password.' ) );
+			return $this->error;
+		}
+
 		// If this isn't on WPMU then just use blogger_getUsersBlogs
 		if ( !is_multisite() ) {
 			array_unshift( $args, 1 );