Vulnerability record · CVE-2018-12895 · published 26 June 2018
CVE-2018-12895: WordPress Author role path traversal enables arbitrary file deletion and code execution
Wordpress · Wordpress
WordPress through 4.9.6 fails to validate filenames in the wp_delete_attachment function in wp-includes/post.php, so the thumb parameter in wp-admin/post.php is passed to PHP unlink without sanitization. An authenticated Author can use directory traversal to delete arbitrary files, notably wp-config.php, and then trigger a fresh installation to gain higher privileges. The flaw matters because a low-privilege content role can escalate to full site compromise.
Description
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with low privileges required and public exploit code, though it needs an authenticated Author account and is not in KEV.
What it is
WordPress through 4.9.6 fails to validate filenames in the wp_delete_attachment function in wp-includes/post.php, so the thumb parameter in wp-admin/post.php is passed to PHP unlink without sanitization. An authenticated Author can use directory traversal to delete arbitrary files, notably wp-config.php, and then trigger a fresh installation to gain higher privileges. The flaw matters because a low-privilege content role can escalate to full site compromise.
Impact
An attacker with Author-level access can delete arbitrary files on the server and, by removing wp-config.php and rerunning the installer, take over the WordPress site and execute code.
Attack surface
Reached over the network through the WordPress admin interface (wp-admin/post.php) with the thumb parameter; the attacker must be authenticated with at least Author capabilities for files and posts, and no user interaction is required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.62162 (99.1st percentile) and public references carry an Exploit tag, indicating a working exploit is publicly available.
What to do
- Upgrade WordPress to a version after 4.9.6 that includes filename validation in wp_delete_attachment.
- Apply the Debian security update DSA-4250 or the corresponding LTS announcement for packaged installs.
- Restrict Author and Editor accounts to trusted users and audit role assignments.
- Harden wp-config.php with restrictive file permissions and consider moving it outside the web root.
- Monitor for unexpected re-runs of the WordPress installation process.
Detection
- Alert on requests to wp-admin/post.php with a thumb parameter containing traversal sequences such as ../.
- Monitor file system events for deletion of wp-config.php or other files outside the uploads directory.
- Detect access to install.php or setup-config.php on an already-installed site.
- Review web server logs for Author-role accounts performing attachment deletion actions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-12895 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-12895), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
