Vulnerability record · CVE-2018-6389 · published 6 February 2018
CVE-2018-6389: WordPress unauthenticated denial of service via script-loader file list
Wordpress · Wordpress
WordPress through 4.9.2 exposes a large list of registered .js files in wp-includes/script-loader.php that unauthenticated attackers can request repeatedly. By constructing a series of requests to load every file many times, an attacker can exhaust server resources and cause a denial of service. The flaw is a resource-consumption issue, not a code execution or data exposure bug.
Description
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated, low-complexity network attack with high availability impact and very high EPSS, though not in KEV.
What it is
WordPress through 4.9.2 exposes a large list of registered .js files in wp-includes/script-loader.php that unauthenticated attackers can request repeatedly. By constructing a series of requests to load every file many times, an attacker can exhaust server resources and cause a denial of service. The flaw is a resource-consumption issue, not a code execution or data exposure bug.
Impact
An attacker can degrade or take down a WordPress site by consuming server resources, denying service to legitimate users. There is no confidentiality or integrity impact; only availability is affected.
Attack surface
Reachable over the network via HTTP requests to the WordPress site; no authentication and no user interaction are required, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Public exploit code and write-ups are referenced, and EPSS is high (0.72671, 99.4th percentile), but the CVE is not listed in CISA KEV, so confirmed in-the-wild exploitation is not established by this record.
What to do
- Upgrade WordPress to a version after 4.9.2 where the issue is addressed, or apply the vendor's recommended fix.
- Deploy a WAF or reverse proxy rule to rate-limit and block repeated requests for wp-includes/js and script-loader.php resources.
- Use server-level rate limiting and connection limits to blunt high-volume request floods.
- Monitor and cap resource usage per client IP to reduce the effect of resource-exhaustion attempts.
- If immediate upgrade is not possible, restrict or cache static .js requests at the edge to reduce backend load.
Detection
- Alert on high-volume or repetitive HTTP requests to wp-includes/js/*.js and script-loader.php from single IPs or user agents.
- Monitor web server CPU, memory and connection counts for sudden spikes correlated with static .js request bursts.
- Review access logs for patterns matching known exploit tools that enumerate the full registered script list.
- Track 5xx and timeout rates on WordPress hosts as an early indicator of resource exhaustion.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-6389 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-6389), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
