Log in Start free

Vulnerability · Published May 17, 2023 · Assigned by Wordfence

CVE-2023-2745WordPress Core < 6.2.1 - Directory Traversal

Medium 5.4

In plain English

A medium-severity path traversal in WordPress from WordPress Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 79.7% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)79.7%top 0.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wordpress6.1.6+dfsg1-0+deb12u1DEBIAN-CVE-2023-2745
Debian:12wordpress6.1.6+dfsg1-0+deb12u1DSA-5685-1
Debian:13wordpress6.2.1+dfsg1-1DEBIAN-CVE-2023-2745
Debian:14wordpress6.2.1+dfsg1-1DEBIAN-CVE-2023-2745
Ubuntu:22.04:LTSwordpressno fix listedUBUNTU-CVE-2023-2745
Ubuntu:24.04:LTSwordpressno fix listedUBUNTU-CVE-2023-2745

Affected products (as reported)

VendorProductVersions
WordPress Foundation WordPress 0 – before 4.1.384.2 – before 4.2.354.3 – before 4.3.314.4 – before 4.4.304.5 – before 4.5.294.6 – before 4.6.264.7 – before 4.7.264.8 – before 4.8.22

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References