What is the vulnerability? #
To speed up the dashboard, WordPress uses load-scripts.php and load-styles.php to merge several files into one request. The problem is that both files work without logging in and accept the list of files from the URL itself.
In February 2018, researcher Barak Tawily published that a single request can ask for dozens of files at once, and that repeating it quickly pushes CPU and memory to the limit. The flaw was registered as CVE-2018-6389.
Why is it dangerous? #
Why did WordPress not fix it? #
The WordPress team considered denial of service attacks a matter for the server and network, not the application, so no change was released. The right fix is in the hosting or the firewall, not in WordPress files.
How to protect your site #
- On Hyyat Host hosting: Protection is enabled. The server checks whether the request comes from a user logged into WordPress, allows it, and blocks suspicious repeated requests.
- On your own server: Add a web application firewall rule that blocks long requests to these two files from visitors who are not logged in, and limit requests per address.
- With Cloudflare: Rate limit the
/wp-admin/load-scripts.phppath, or turn on Under Attack mode during an attack.
How Hyyat Host protects your site #
- Server rules allow load-scripts.php requests for logged-in users only and block suspicious ones.
- Imunify360, ModSecurity rules and CSF limit repeated requests from the same address.
- Account isolation with CloudLinux keeps an attack on another site from taking yours down.
Learn more about Hyyat Host DoS protection.
Frequently asked questions #
Is my site exposed right now?
The file exists on every WordPress site. If your site is hosted with Hyyat Host, protection is enabled on the server side.
Does the flaw steal my data?
No. It is a denial of service flaw: it slows or stops the site, but gives the attacker no access to the site or its data.
Is a WordPress security plugin enough?
Not on its own, because the request uses resources before the plugin runs. Effective protection lives on the server or the network.
