CVE-2018-6389
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource...
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
- Record
CVE-2018-6389- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
- Record
CVE-2018-6389- Updated
- 2026-11-02
EUVDEUVD-2018-18146 No score
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
- Record
EUVD-2018-18146- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxcx-cprx-mr28
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource...
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
- Record
GHSA-pxcx-cprx-mr28- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
- Record
CVE-2018-6389- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-6389
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
- Record
DEBIAN-CVE-2018-6389- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-6389
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
- Record
UBUNTU-CVE-2018-6389- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
All versions, plus listed versions 6.1.1+dfsg1-16.1.6+dfsg1-0+deb12u16.1.9+dfsg1-0+deb12u16.2+dfsg1-16.2.1+dfsg1-1 Show 26 moreShow less6.2.2+dfsg1-16.3+dfsg1-16.3.1+dfsg1-16.3.2+dfsg1-16.4.1+dfsg1-16.4.1+dfsg1-1.16.4.2+dfsg1-16.4.3+dfsg1-16.5+dfsg1-16.5.2+dfsg1-16.5.3+dfsg1-16.5.5+dfsg1-16.6.1+dfsg1-16.7.2+dfsg1-16.7.2+dfsg1-1.16.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
wordpressDebian:13 |
All versions, plus listed versions 6.8.1+dfsg1-16.8.10+dfsg1-0+deb13u16.8.3+dfsg1-0+deb13u16.8.3+dfsg1-16.8.6+dfsg1-0+deb13u1 Show 10 moreShow less6.8.7+dfsg1-0+deb13u16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
wordpressDebian:14 |
All versions, plus listed versions 6.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-1 Show 6 moreShow less7.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 |
None known |
wordpressUbuntu:16.04:LTS |
All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1 |
None known |
wordpressUbuntu:18.04:LTS |
All versions, plus listed versions 4.8.2+dfsg-24.8.3+dfsg-14.9.1+dfsg-14.9.2+dfsg-14.9.4+dfsg-14.9.5+dfsg1-1 |
None known |
wordpressUbuntu:20.04:LTS |
All versions, plus listed versions 5.2.2+dfsg1-15.2.4+dfsg1-15.3.2+dfsg1-15.3.2+dfsg1-1ubuntu1 |
None known |
wordpressUbuntu:22.04:LTS |
All versions, plus listed versions 5.7.1+dfsg1-2ubuntu15.8.1+dfsg1-2ubuntu15.8.2+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu1.1 |
None known |
wordpressUbuntu:24.04:LTS |
All versions, plus listed versions 6.2+dfsg1-1ubuntu16.4.3+dfsg1-1ubuntu1 |
None known |
wordpressUbuntu:25.10 |
All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu1 |
None known |
wordpressUbuntu:26.10 |
All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu2 |
None known |
wordpressUbuntu:26.04:LTS |
All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu16.7.2+dfsg1-1.1ubuntu2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Core - 'load-scripts.php' Denial of Service | 2018-02-05 |
| PoC in GitHub | BlackRouter/cve-2018-6389 | 2018-02-26 |
| PoC in GitHub | ItinerisLtd/trellis-cve-2018-6389 | 2018-08-30 |
| PoC in GitHub | JavierOlmedo/wordpress-cve-2018-6389 | 2018-03-01 |
| PoC in GitHub | Jetserver/CVE-2018-6389-FIX | 2018-02-15 |
| PoC in GitHub | JulienGadanho/cve-2018-6389-php-patcher | 2018-02-07 |
| PoC in GitHub | Zazzzles/Wordpress-DOS | 2018-10-28 |
| PoC in GitHub | alessiogilardi/PoC---CVE-2018-6389 | 2018-02-28 |
| PoC in GitHub | amit-pathak009/CVE-2018-6389-FIX | 2023-01-23 |
| PoC in GitHub | armaanpathan12345/WP-DOS-Exploit-CVE-2018-6389 | 2018-05-04 |
Show 13 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dsfau/wordpress-CVE-2018-6389 | 2018-02-09 |
| PoC in GitHub | fakedob/tvsz | 2019-01-06 |
| PoC in GitHub | ianxtianxt/CVE-2018-6389 | 2019-12-22 |
| PoC in GitHub | knqyf263/CVE-2018-6389 | 2018-02-07 |
| PoC in GitHub | m3ssap0/wordpress_cve-2018-6389 | 2018-03-04 |
| PoC in GitHub | mudhappy/Wordpress-Hack-CVE-2018-6389 | 2018-04-20 |
| PoC in GitHub | omidsec/CVE-2018-6389 | 2025-11-13 |
| PoC in GitHub | rastating/modsecurity-cve-2018-6389 | 2018-02-06 |
| PoC in GitHub | s0md3v/Shiva | 2018-03-04 |
| PoC in GitHub | safebuffer/CVE-2018-6389 | 2018-02-06 |
| PoC in GitHub | thechrono13/PoC---CVE-2018-6389 | 2018-02-25 |
| PoC in GitHub | vineetkia/Wordpress-DOS-Attack-CVE-2018-6389 | 2019-11-11 |
| PoC in GitHub | yolabingo/wordpress-fix-cve-2018-6389 | 2018-02-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-6389 is a high vulnerability (CVSS 7.5) in Wordpress, published February 6, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.7%, the 99th percentile. No source names a fixed version.
