PoC Index 85,101 CVEs with PoCs

CVE-2018-6389

HIGH 7.5EPSS 72.7%

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

CVSS v3.0 NVD: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 NVD: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS: 72.67% chance of exploitation in the next 30 days, 99th percentile
Nuclei: low
Published: 2018-02-06
Updated: 2024-08-05

Proof-of-concept exploits (24)

https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html
https://thehackernews.com/2018/02/wordpress-dos-exploit.html
Adelittle/Wordpressz_Dos_CVE_2018_63890★ · 2020-02-02
BiswajeetRay7/Loadscript-payload2★ · 2022-11-05
BlackRouter/cve-2018-63890★ · 2018-02-26
ItinerisLtd/trellis-cve-2018-638913★ · 2018-08-30
JavierOlmedo/wordpress-cve-2018-63892★ · 2018-03-07
JulienGadanho/cve-2018-6389-php-patcher1★ · 2018-02-13
Zazzzles/Wordpress-DOS4★ · 2018-11-01
alessiogilardi/PoC---CVE-2018-63890★ · 2019-03-04
armaanpathan12345/WP-DOS-Exploit-CVE-2018-63891★ · 2018-05-04
bogdanovist2061/Project-7---WordPress-Pentesting0★ · 2018-04-14
dsfau/wordpress-CVE-2018-63892★ · 2018-02-09
fakedob/tvsz0★ · 2019-01-06
ianxtianxt/CVE-2018-63893★ · 2019-12-22
knqyf263/CVE-2018-638910★ · 2018-02-07
m3ssap0/wordpress_cve-2018-63892★ · 2018-03-10
mudhappy/Wordpress-Hack-CVE-2018-63890★ · 2018-04-20
rastating/modsecurity-cve-2018-63890★ · 2018-02-07
s0md3v/Shiva131★ · 2020-10-01
safebuffer/CVE-2018-638983★ · 2018-02-06
thechrono13/PoC---CVE-2018-63890★ · 2018-02-26
vineetkia/Wordpress-DOS-Attack-CVE-2018-63891★ · 2019-11-11
omidsec/CVE-2018-63897★ · 2025-11-24

Nuclei templates (1)

linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/cve-2018-6389-3579.yaml

ExploitDB entries (1)

https://www.exploit-db.com/exploits/43968

Security advisories

References

Related