Vulnerability · Published May 17, 2023 · Assigned by Wordfence
CVE-2023-2745WordPress Core < 6.2.1 - Directory Traversal
Medium 5.4
In plain English
A medium-severity path traversal in WordPress from WordPress Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 79.7% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | wordpress | 6.1.6+dfsg1-0+deb12u1 | DEBIAN-CVE-2023-2745 |
| Debian:12 | wordpress | 6.1.6+dfsg1-0+deb12u1 | DSA-5685-1 |
| Debian:13 | wordpress | 6.2.1+dfsg1-1 | DEBIAN-CVE-2023-2745 |
| Debian:14 | wordpress | 6.2.1+dfsg1-1 | DEBIAN-CVE-2023-2745 |
| Ubuntu:22.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2023-2745 |
| Ubuntu:24.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2023-2745 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WordPress Foundation | WordPress | 0 – before 4.1.384.2 – before 4.2.354.3 – before 4.3.314.4 – before 4.4.304.5 – before 4.5.294.6 – before 4.6.264.7 – before 4.7.264.8 – before 4.8.22 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve
- https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/
- https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=
- https://www.wordfence.com/blog/2023/05/wordpress-core-6-2-1-security-maintenance-release-what-you-need-to-know/
- https://www.exploit-db.com/exploits/52274
- http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html x_transferred
- https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html x_transferred