{"id":"CVE-2018-6389","aliases":["DEBIAN-CVE-2018-6389","EUVD-2018-18146","GHSA-pxcx-cprx-mr28","UBUNTU-CVE-2018-6389"],"status":"published","title":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource...","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.72671,"percentile":0.99449,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-400"],"published":"2018-02-06T17:00:00Z","modified":"2026-10-24T10:30:42Z","exploits":[{"source":"exploitdb","id":"EDB-43968","title":"WordPress Core - 'load-scripts.php' Denial of Service","type":"dos","platform":"php","date":"2018-02-05","url":"https://www.exploit-db.com/exploits/43968"},{"source":"pocgithub","id":"BlackRouter/cve-2018-6389","title":"BlackRouter/cve-2018-6389","date":"2018-02-26","url":"https://github.com/BlackRouter/cve-2018-6389"},{"source":"pocgithub","id":"ItinerisLtd/trellis-cve-2018-6389","title":"ItinerisLtd/trellis-cve-2018-6389","date":"2018-08-30","url":"https://github.com/ItinerisLtd/trellis-cve-2018-6389"},{"source":"pocgithub","id":"JavierOlmedo/wordpress-cve-2018-6389","title":"JavierOlmedo/wordpress-cve-2018-6389","date":"2018-03-01","url":"https://github.com/JavierOlmedo/wordpress-cve-2018-6389"},{"source":"pocgithub","id":"Jetserver/CVE-2018-6389-FIX","title":"Jetserver/CVE-2018-6389-FIX","date":"2018-02-15","url":"https://github.com/Jetserver/CVE-2018-6389-FIX"},{"source":"pocgithub","id":"JulienGadanho/cve-2018-6389-php-patcher","title":"JulienGadanho/cve-2018-6389-php-patcher","date":"2018-02-07","url":"https://github.com/JulienGadanho/cve-2018-6389-php-patcher"},{"source":"pocgithub","id":"Zazzzles/Wordpress-DOS","title":"Zazzzles/Wordpress-DOS","date":"2018-10-28","url":"https://github.com/Zazzzles/Wordpress-DOS"},{"source":"pocgithub","id":"alessiogilardi/PoC---CVE-2018-6389","title":"alessiogilardi/PoC---CVE-2018-6389","date":"2018-02-28","url":"https://github.com/alessiogilardi/PoC---CVE-2018-6389"},{"source":"pocgithub","id":"amit-pathak009/CVE-2018-6389-FIX","title":"amit-pathak009/CVE-2018-6389-FIX","date":"2023-01-23","url":"https://github.com/amit-pathak009/CVE-2018-6389-FIX"},{"source":"pocgithub","id":"armaanpathan12345/WP-DOS-Exploit-CVE-2018-6389","title":"armaanpathan12345/WP-DOS-Exploit-CVE-2018-6389","date":"2018-05-04","url":"https://github.com/armaanpathan12345/WP-DOS-Exploit-CVE-2018-6389"},{"source":"pocgithub","id":"dsfau/wordpress-CVE-2018-6389","title":"dsfau/wordpress-CVE-2018-6389","date":"2018-02-09","url":"https://github.com/dsfau/wordpress-CVE-2018-6389"},{"source":"pocgithub","id":"fakedob/tvsz","title":"fakedob/tvsz","date":"2019-01-06","url":"https://github.com/fakedob/tvsz"},{"source":"pocgithub","id":"ianxtianxt/CVE-2018-6389","title":"ianxtianxt/CVE-2018-6389","date":"2019-12-22","url":"https://github.com/ianxtianxt/CVE-2018-6389"},{"source":"pocgithub","id":"knqyf263/CVE-2018-6389","title":"knqyf263/CVE-2018-6389","date":"2018-02-07","url":"https://github.com/knqyf263/CVE-2018-6389"},{"source":"pocgithub","id":"m3ssap0/wordpress_cve-2018-6389","title":"m3ssap0/wordpress_cve-2018-6389","date":"2018-03-04","url":"https://github.com/m3ssap0/wordpress_cve-2018-6389"},{"source":"pocgithub","id":"mudhappy/Wordpress-Hack-CVE-2018-6389","title":"mudhappy/Wordpress-Hack-CVE-2018-6389","date":"2018-04-20","url":"https://github.com/mudhappy/Wordpress-Hack-CVE-2018-6389"},{"source":"pocgithub","id":"omidsec/CVE-2018-6389","title":"omidsec/CVE-2018-6389","date":"2025-11-13","url":"https://github.com/omidsec/CVE-2018-6389"},{"source":"pocgithub","id":"rastating/modsecurity-cve-2018-6389","title":"rastating/modsecurity-cve-2018-6389","date":"2018-02-06","url":"https://github.com/rastating/modsecurity-cve-2018-6389"},{"source":"pocgithub","id":"s0md3v/Shiva","title":"s0md3v/Shiva","date":"2018-03-04","url":"https://github.com/s0md3v/Shiva"},{"source":"pocgithub","id":"safebuffer/CVE-2018-6389","title":"safebuffer/CVE-2018-6389","date":"2018-02-06","url":"https://github.com/safebuffer/CVE-2018-6389"},{"source":"pocgithub","id":"thechrono13/PoC---CVE-2018-6389","title":"thechrono13/PoC---CVE-2018-6389","date":"2018-02-25","url":"https://github.com/thechrono13/PoC---CVE-2018-6389"},{"source":"pocgithub","id":"vineetkia/Wordpress-DOS-Attack-CVE-2018-6389","title":"vineetkia/Wordpress-DOS-Attack-CVE-2018-6389","date":"2019-11-11","url":"https://github.com/vineetkia/Wordpress-DOS-Attack-CVE-2018-6389"},{"source":"pocgithub","id":"yolabingo/wordpress-fix-cve-2018-6389","title":"yolabingo/wordpress-fix-cve-2018-6389","date":"2018-02-06","url":"https://github.com/yolabingo/wordpress-fix-cve-2018-6389"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1+dfsg1-1","6.1.6+dfsg1-0+deb12u1","6.1.9+dfsg1-0+deb12u1","6.2+dfsg1-1","6.2.1+dfsg1-1","6.2.2+dfsg1-1","6.3+dfsg1-1","6.3.1+dfsg1-1","6.3.2+dfsg1-1","6.4.1+dfsg1-1","6.4.1+dfsg1-1.1","6.4.2+dfsg1-1","6.4.3+dfsg1-1","6.5+dfsg1-1","6.5.2+dfsg1-1","6.5.3+dfsg1-1","6.5.5+dfsg1-1","6.6.1+dfsg1-1","6.7.2+dfsg1-1","6.7.2+dfsg1-1.1","6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1","7.1.1+dfsg1-1","7.1.2+dfsg1-1","7.1.3+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1+dfsg1-1","6.8.10+dfsg1-0+deb13u1","6.8.3+dfsg1-0+deb13u1","6.8.3+dfsg1-1","6.8.6+dfsg1-0+deb13u1","6.8.7+dfsg1-0+deb13u1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1","7.1.1+dfsg1-1","7.1.2+dfsg1-1","7.1.3+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1","7.1.1+dfsg1-1","7.1.2+dfsg1-1","7.1.3+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1","6.7.2+dfsg1-1.1ubuntu2"]}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"http://www.securityfocus.com/bid/103060","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://wpvulndb.com/vulnerabilities/9021","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.exploit-db.com/exploits/43968/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.securitytracker.com/id/1040347","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://thehackernews.com/2018/02/wordpress-dos-exploit.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/WazeHell/CVE-2018-6389","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/UltimateHackers/Shiva","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6389"},{"url":"https://github.com/advisories/GHSA-pxcx-cprx-mr28"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-6389","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-6389","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6389","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-6389","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","status":"published","published":"2018-02-06T17:00:00Z","modified":"2024-08-05T06:01:49.194Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-18146","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","status":"published","published":"2018-02-06T17:00:00Z","modified":"2024-08-05T06:01:49Z","updated_at":"2026-11-03T02:40:08.072854Z"}],"ghsa":[{"id":"GHSA-pxcx-cprx-mr28","title":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource...","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","status":"published","published":"2022-05-14T01:29:43Z","modified":"2023-02-02T05:04:09Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:51:47.947252Z"}],"nvd":[{"id":"CVE-2018-6389","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","status":"published","published":"2018-02-06T17:29:00.253Z","modified":"2026-06-17T02:01:46.95Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-6389","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","status":"published","published":"2018-02-06T17:29:00.253Z","modified":"2026-10-24T10:30:42.042181091Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-6389","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","status":"published","published":"2018-02-06T17:29:00.253Z","modified":"2026-10-23T18:03:07.65424864Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"UBUNTU-CVE-2018-6389","description":"In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.","status":"published","published":"2018-02-06T17:29:00Z","modified":"2026-10-17T12:55:28.051449489Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"}]}}