AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2018-12895

HIGH · CVSS 8.8 EPSS 62.56% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-06-26 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

Exhibit — Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

External Security References

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2018-12895
Severity
HIGH
CVSS
8.8
EPSS
62.56%
WordPress

Original Filing — NVD Description

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.