Think you might have misread me there. Using the WordPress app over 3G is fairly unlikely to get sniffed. So actually I'd say you're probably safe there. It's one of those "it's possible if you're a hacker who is presenting how to do it at DefCon" type of things.

I just don't want anybody to get the impression that XML-RPC is insecure. It's the traffic that is non-encrypted. XML-RPC is just the protocol being used, and yes, it has your credentials sent along with it.

WiFi is simply insecure in general. Public WiFi even more so.