← Back

CVE-2023-2745

nvd nistnuclei
Published: May 17, 2023Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD (Secondary)

Description

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Affected (22)

Products: Wordpress: Wordpress
Wordpress
1 product
Wordpress
Configuration A
22 vulnerable
Vulnerable SoftwareAffected Versions
Wordpress
Wordpress
Before 4.1.38
Wordpress
From 4.2 to 4.2.35
Wordpress
From 4.3 to 4.3.31
Wordpress
From 4.4 to 4.4.30
Wordpress
From 4.5 to 4.5.29
Wordpress
From 4.6 to 4.6.26
Wordpress
From 4.7 to 4.7.26
Wordpress
From 4.8 to 4.8.22
Wordpress
From 4.9 to 4.9.23
Wordpress
From 5.0 to 5.0.19
Wordpress
From 5.1 to 5.1.16
Wordpress
From 5.2 to 5.2.18
Wordpress
From 5.3 to 5.3.15
Wordpress
From 5.4 to 5.4.13
Wordpress
From 5.5 to 5.5.12
Wordpress
From 5.6 to 5.6.11
Wordpress
From 5.7 to 5.7.9
Wordpress
From 5.8 to 5.8.7
Wordpress
From 5.9 to 5.9.6
Wordpress
From 6.0 to 6.0.4
Wordpress
From 6.1 to 6.1.2
Wordpress
Version 6.2

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (10)

Source: security@wordfence.com
Patch
Source: security@wordfence.com
Release Notes
Source: security@wordfence.com
Source: security@wordfence.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.