WordPress is the most popular Content Management System (CMS) in the entire world. In fact, WordPress powers 29% of the web<\/a>. That\u2019s why it\u2019s alarming the company isn\u2019t going to patch a DoS vulnerability<\/a> that, when exploited, could easily bring down an entire website.<\/span><\/p>\n Let\u2019s start back at the beginning.<\/p>\n Israeli research Barak Tawily<\/a> discovered a vulnerability\u00a0(CVE-2018-6389<\/a>) in the way that \u201cload-scripts.php\u201d processes user-defined requests. \u201cload-scripts.php\u201d is a built-in script that was designed for users with admin permissions to help improve website performance and page load speeds by combining JavaScript files into a single request.<\/p>\n To do this, \u201cload-scripts.php\u201d calls the required JavaScript files by passing their names into its load parameter. Once it\u2019s called every JavaScript file in a given URL it sends them back in a single file.<\/p>\n That\u2019s a lot to untangle, maybe this comparison will help. This script acts kind of like a project manager would: they manage a bunch of different inputs from different team members, then organize it into one coherent document before presenting it to management.<\/p>\n Unfortunately, WordPress, in attempting to make \u201cload-scripts.php\u201d work on the admin login page, forgot to put authentication in place. That means that it\u2019s accessible to anyone.<\/p>\n Here\u2019s where the exploit comes in. Because the \u201cload-scripts.php\u201d file is accessible to anyone an attacker can bring down an entire website simply by forcing \u201cload-scripts.php\u201d to call all possible JavaScript files in one go by passing their names into the Load Parameter. That, in turn, makes the targeted website slow to a crawl due to high usage of the CPU and server memory.<\/p>\nWhat is the WordPress Vulnerability?<\/h2>\n