CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does have the required capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that plugin, because a machine's wp-content/plugins directory permissions were set up to block all new plugins.

We have discovered 530,575 live websites that are affected by CVE-2018-14028.

Run a Free Instant Scan



Affected Software

Product  WordPress
Category Content Management System
Vulnerable Domains530,575 live websites (6.56% of WordPress install base)
Vulnerable Versions
  • from 0 through 4.9.7
Vulnerable Versions Count928 versions ( 63% of all versions)



Details

  • Published - Aug 10, 2018
  • Updated - Aug 5, 2024

Website Distribution by Country

Number of websites using CVE-2018-14028
United States106,533 websites


Italy53,757 websites
Japan52,220 websites
Germany40,449 websites
Russia29,657 websites
France25,733 websites
GB19,908 websites
Netherlands15,102 websites
Poland12,688 websites
Spain11,476 websites

Website Distribution by TLD

Number of websites using CVE-2018-14028
.com199,228 websites
.it35,928 websites
.ru24,721 websites
.de20,914 websites
.org19,856 websites
.net17,641 websites
.jp12,271 websites
.nl12,056 websites
.co.uk11,685 websites
.fr10,188 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2018-14028

Top websites that are affected by CVE-2018-14028. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.br Brazil***
*******.com United States*,***
*****.com United States*,***
************.org United States*,***
*****.****.br Brazil*,***
*******.org United States*,***
********.****.br Brazil*,***
*********.io Netherlands*,***
***********.com United States*,***
*******.com United States*,***
See full domain list

FAQ

A total of 530,575 websites have been identified as vulnerable to CVE-2018-14028, based on global website indexing conducted by WebTechSurvey.
The WordPress is affected by the CVE-2018-14028 vulnerability.
WordPress versions up to and including 4.9.7 are vulnerable to CVE-2018-14028.