onyx

onyx --cves cve-2018-14028

CVE-2018-14028

HIGHKEVPOCWordPress
score
0.7
cvss
7.2
epss
15.2%
published
2018-08-10
kev added
2026-04-15
first seen

WordPress 4.9.7 contains a PHP file upload vulnerability caused by lack of ZIP file verification during plugin uploads in the admin area, letting attackers upload and execute PHP files, exploit requires plugin upload capabilities.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2018-08-10 — PublishedP2026-04-15 — Added to CISA KEVK2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoC: https://github.com/rastating/wordpress-exploit-framework/pull/52Xscore2026-10-21: score 0.70.7epss2026-09-22: epss 15.2%2026-09-23: epss 15.2%2026-09-24: epss 15.2%2026-09-25: epss 15.2%2026-09-26: epss 15.2%2026-09-27: epss 15.2%2026-09-28: epss 15.2%2026-09-29: epss 15.2%2026-09-30: epss 15.2%2026-10-01: epss 15.2%2026-10-02: epss 15.4%2026-10-03: epss 15.4%2026-10-04: epss 15.4%2026-10-05: epss 15.4%2026-10-06: epss 15.4%2026-10-07: epss 15.4%2026-10-08: epss 15.4%2026-10-09: epss 15.4%2026-10-10: epss 15.4%2026-10-11: epss 15.4%2026-10-12: epss 15.4%2026-10-13: epss 15.4%2026-10-14: epss 15.4%2026-10-15: epss 15.2%2026-10-16: epss 15.2%2026-10-18: epss 15.2%2026-10-19: epss 15.2%2026-10-20: epss 15.2%2026-10-21: epss 15.2%15.2%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Added to CISA KEV
  3. Tracked by Onyx
  4. Public PoC https://github.com/rastating/wordpress-exploit-framework/pull/52

Exploit availability

Weaknesses

CWE-434

References 5