CVE-2023-2745

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2745
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
CVSS

No CVSS.

References
Link Resource
http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html Third Party Advisory VDB Entry
https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= Patch
https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= Patch
https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html
https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ Release Notes
https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ Release Notes
https://www.exploit-db.com/exploits/52274
https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:wordpress:wordpress:6.2:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
History

24 Apr 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.4 		v2 : unknown
v3 : unknown
CWE CWE-22
References
  • () https://www.exploit-db.com/exploits/52274 -
References (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve - Third Party Advisory
References (MISC) http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html - Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html - Third Party Advisory, VDB Entry
References (MISC) https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ - Release Notes () https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ - Release Notes
References (MISC) https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html - () https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html -
References (MISC) https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= - Patch () https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= - Patch

07 Nov 2023, 04:13

Type Values Removed Values Added
CWE CWE-22

21 Jun 2023, 01:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 5.4
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html -

26 May 2023, 02:20

Type Values Removed Values Added
CWE CWE-22
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
First Time Wordpress
Wordpress wordpress
References (MISC) http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html - (MISC) http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html - Third Party Advisory, VDB Entry
References (MISC) https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= - (MISC) https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= - Patch
References (MISC) https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ - (MISC) https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ - Release Notes
References (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve - (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve - Third Party Advisory
CPE cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:6.2:*:*:*:*:*:*:*

17 May 2023, 17:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html -

17 May 2023, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-17 09:15

Updated : 2025-04-24 19:15

NVD link : CVE-2023-2745

Mitre link : CVE-2023-2745

JSON object : View

Products Affected

wordpress

  • wordpress
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')