WordPress Vulnerabilities

WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)

Description

An application Denial of Service (DoS) was found to affect WordPress versions 4.9.4 and below. We are not aware of a patch for this issue.

Affects WordPress

3.8.1
No known fix
3.8
No known fix
3.7.1
No known fix
3.6
No known fix
3.5.2
No known fix
3.5.1
No known fix
3.5
No known fix
3.4.2
No known fix
3.4.1
No known fix
3.4
No known fix
3.3.3
No known fix
3.3.2
No known fix
3.3.1
No known fix
3.3
No known fix
3.2.1
No known fix
3.2
No known fix
3.1.4
No known fix
3.1.3
No known fix
3.1.2
No known fix
3.1.1
No known fix
3.1
No known fix
3.0.6
No known fix
3.0.5
No known fix
3.0.4
No known fix
3.0.3
No known fix
3.0.2
No known fix
3.0.1
No known fix
3.0
No known fix
2.9.2
No known fix
2.9.1
No known fix
2.9
No known fix
2.8.6
No known fix
2.8.5
No known fix
2.8.4
No known fix
2.8.3
No known fix
2.8.2
No known fix
2.8.1
No known fix
2.8
No known fix
2.7.1
No known fix
2.7
No known fix
2.6.5
No known fix
2.6.3
No known fix
2.6.2
No known fix
2.6.1
No known fix
2.6
No known fix
2.5.1
No known fix
2.5
No known fix
2.3.3
No known fix
2.3.2
No known fix
2.3.1
No known fix
2.3
No known fix
2.2.3
No known fix
2.2.2
No known fix
2.2.1
No known fix
2.2
No known fix
2.1.3
No known fix
2.1.2
No known fix
2.1.1
No known fix
2.1
No known fix
2.0.11
No known fix
2.0.10
No known fix
2.0.9
No known fix
2.0.8
No known fix
2.0.7
No known fix
2.0.6
No known fix
2.0.5
No known fix
2.0.4
No known fix
2.0.3
No known fix
2.0.2
No known fix
2.0.1
No known fix
2.0
No known fix
1.5.2
No known fix
1.5.1.3
No known fix
1.5.1.2
No known fix
1.5.1.1
No known fix
1.5.1
No known fix
1.5
No known fix
3.6.1
No known fix
3.9
No known fix
3.9.1
No known fix
3.7
No known fix
3.8.2
No known fix
3.8.3
No known fix
3.9.2
No known fix
4.0
No known fix
1.2
No known fix
1.2.1
No known fix
0.70
No known fix
4.1
No known fix
4.1.1
No known fix
4.2
No known fix
3.9.3
No known fix
4.1.2
No known fix
4.2.1
No known fix
4.0.1
No known fix
4.1.5
No known fix
4.1.4
No known fix
4.1.3
No known fix
3.8.4
No known fix
3.7.4
No known fix
4.2.3
No known fix
3.8.8
No known fix
3.8.5
No known fix
3.8.6
No known fix
3.8.7
No known fix
0.71
No known fix
0.711
No known fix
0.72
No known fix
1.0
No known fix
1.0.1
No known fix
1.0.2
No known fix
1.2.2
No known fix
3.7.2
No known fix
3.7.3
No known fix
3.7.5
No known fix
3.7.6
No known fix
3.7.7
No known fix
3.7.8
No known fix
3.7.9
No known fix
3.8.9
No known fix
3.9.4
No known fix
3.9.5
No known fix
3.9.6
No known fix
3.9.7
No known fix
4.0.2
No known fix
4.0.3
No known fix
4.0.4
No known fix
4.0.5
No known fix
4.0.6
No known fix
4.1.6
No known fix
4.2.2
No known fix
4.2.4
No known fix
4.1.7
No known fix
4.0.7
No known fix
3.9.8
No known fix
3.8.10
No known fix
3.7.10
No known fix
4.3
No known fix
4.3.1
No known fix
4.2.5
No known fix
4.1.8
No known fix
4.0.8
No known fix
3.9.9
No known fix
3.8.11
No known fix
3.7.11
No known fix
4.4
No known fix
3.7.12
No known fix
3.8.12
No known fix
3.9.10
No known fix
4.0.9
No known fix
4.1.9
No known fix
4.2.6
No known fix
4.3.2
No known fix
4.4.1
No known fix
4.4.2
No known fix
4.3.3
No known fix
4.2.7
No known fix
4.1.10
No known fix
4.0.10
No known fix
3.9.11
No known fix
3.8.13
No known fix
3.7.13
No known fix
4.5
No known fix
4.5.1
No known fix
3.7.14
No known fix
3.8.14
No known fix
3.9.12
No known fix
4.0.11
No known fix
4.1.11
No known fix
4.2.8
No known fix
4.3.4
No known fix
4.4.3
No known fix
4.5.2
No known fix
4.5.3
No known fix
3.7.15
No known fix
3.8.15
No known fix
3.9.13
No known fix
4.0.12
No known fix
4.1.12
No known fix
4.2.9
No known fix
4.3.5
No known fix
4.4.4
No known fix
4.6
No known fix
3.7.16
No known fix
3.8.16
No known fix
3.9.14
No known fix
4.0.13
No known fix
4.1.13
No known fix
4.2.10
No known fix
4.3.6
No known fix
4.4.5
No known fix
4.5.4
No known fix
4.6.1
No known fix
4.7
No known fix
3.7.17
No known fix
3.8.17
No known fix
3.9.15
No known fix
4.0.14
No known fix
4.1.14
No known fix
4.2.11
No known fix
4.3.7
No known fix
4.4.6
No known fix
4.5.5
No known fix
4.7.1
No known fix
4.6.2
No known fix
3.7.18
No known fix
3.8.18
No known fix
3.9.16
No known fix
4.0.15
No known fix
4.1.15
No known fix
4.2.12
No known fix
4.3.8
No known fix
4.4.7
No known fix
4.5.6
No known fix
4.6.3
No known fix
4.7.2
No known fix
3.7.19
No known fix
3.8.19
No known fix
3.9.17
No known fix
4.0.16
No known fix
4.1.16
No known fix
4.2.13
No known fix
4.3.9
No known fix
4.4.8
No known fix
4.5.7
No known fix
4.6.4
No known fix
4.7.3
No known fix
3.7.20
No known fix
3.8.20
No known fix
3.9.18
No known fix
4.0.17
No known fix
4.1.17
No known fix
4.2.14
No known fix
4.3.10
No known fix
4.4.9
No known fix
4.5.8
No known fix
4.6.5
No known fix
4.7.4
No known fix
4.7.5
No known fix
3.7.21
No known fix
3.8.21
No known fix
3.9.19
No known fix
4.0.18
No known fix
4.1.18
No known fix
4.2.15
No known fix
4.3.11
No known fix
4.4.10
No known fix
4.5.9
No known fix
4.6.6
No known fix
4.8
No known fix
4.8.1
No known fix
3.7.22
No known fix
3.8.22
No known fix
3.9.20
No known fix
4.0.19
No known fix
4.1.19
No known fix
4.2.16
No known fix
4.3.12
No known fix
4.4.11
No known fix
4.5.10
No known fix
4.6.7
No known fix
4.7.6
No known fix
4.8.2
No known fix
4.8.3
No known fix
3.7.23
No known fix
3.8.23
No known fix
3.9.21
No known fix
4.0.20
No known fix
4.1.20
No known fix
4.2.17
No known fix
4.3.13
No known fix
4.4.12
No known fix
4.5.11
No known fix
4.6.8
No known fix
4.7.7
No known fix
4.9
No known fix
4.9.1
No known fix
4.8.4
No known fix
4.7.8
No known fix
4.6.9
No known fix
4.5.12
No known fix
4.4.13
No known fix
4.3.14
No known fix
4.2.18
No known fix
4.1.21
No known fix
4.0.21
No known fix
3.9.22
No known fix
3.8.24
No known fix
3.7.24
No known fix
4.9.2
No known fix
4.8.5
No known fix
4.7.9
No known fix
4.6.10
No known fix
4.5.13
No known fix
4.4.14
No known fix
4.3.15
No known fix
4.2.19
No known fix
4.1.22
No known fix
4.0.22
No known fix
3.9.23
No known fix
3.8.25
No known fix
3.7.25
No known fix
4.9.3
No known fix
4.9.4
No known fix

References

CVE
CVE-2018-6389
URL
https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html
URL
https://github.com/quitten/doser.py
URL
https://thehackernews.com/2018/02/wordpress-dos-exploit.html

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
5e0c1ddd-fdd0-421b-bdbe-3eee6b75c919

Timeline

Publicly Published
2018-02-05 (about 8 years ago)
Added
2018-02-05 (about 8 years ago)
Last Updated
2021-02-22 (about 5 years ago)

Other

Published
Title
Published
2026-08-03
Title
WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
Published
2021-12-06
Title
Stars Rating < 3.5.1 - Comments Denial of Service
Published
2025-09-25
Title
Download After Email 2.1.5 - 2.1.6 - Unauthorized Repeated Form Submissions
Published
2025-03-27
Title
Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging
Published
2015-07-02
Title
Simple Ads Manager < 2.9.4.116 - Unauthenticated Denial of Service (DoS)