CVE-2023-2745

Published: May 17, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD (Secondary)

Description

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Affected (22)

Products: Wordpress: Wordpress

Wordpress

1 product

Wordpress

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	version < 4.1.38
Wordpress Wordpress	4.2 ≤ version < 4.2.35
Wordpress Wordpress	4.3 ≤ version < 4.3.31
Wordpress Wordpress	4.4 ≤ version < 4.4.30
Wordpress Wordpress	4.5 ≤ version < 4.5.29
Wordpress Wordpress	4.6 ≤ version < 4.6.26
Wordpress Wordpress	4.7 ≤ version < 4.7.26
Wordpress Wordpress	4.8 ≤ version < 4.8.22
Wordpress Wordpress	4.9 ≤ version < 4.9.23
Wordpress Wordpress	5.0 ≤ version < 5.0.19
Wordpress Wordpress	5.1 ≤ version < 5.1.16
Wordpress Wordpress	5.2 ≤ version < 5.2.18
Wordpress Wordpress	5.3 ≤ version < 5.3.15
Wordpress Wordpress	5.4 ≤ version < 5.4.13
Wordpress Wordpress	5.5 ≤ version < 5.5.12
Wordpress Wordpress	5.6 ≤ version < 5.6.11
Wordpress Wordpress	5.7 ≤ version < 5.7.9
Wordpress Wordpress	5.8 ≤ version < 5.8.7
Wordpress Wordpress	5.9 ≤ version < 5.9.6
Wordpress Wordpress	6.0 ≤ version < 6.0.4
Wordpress Wordpress	6.1 ≤ version < 6.1.2
Wordpress Wordpress	Version 6.2