CVE-2023-2745: WordPress Core < 6.2.1 - Directory Traversal

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-2745.

Q: What is the title of this vulnerability?

The title of this vulnerability is 'WordPress Core is vulnerable to Directory Traversal in versions up to and including 6.2 via the ‘wp_lang’ parameter.'

Q: What is the severity of CVE-2023-2745?

The severity of CVE-2023-2745 is medium (5.4).

Q: How does CVE-2023-2745 impact WordPress?

CVE-2023-2745 allows unauthenticated attackers to access and load arbitrary translation files in WordPress versions up to and including 6.2.

Q: Are there any known fixes for CVE-2023-2745?

At the moment, there are no known fixes for CVE-2023-2745. It is recommended to update to a newer version of WordPress when a fix becomes available.

Published May 17, 2023

Updated

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wplang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Affected Software

22 affected components

WordPress<4.1.38

WordPress>=4.2<4.2.35

WordPress>=4.3<4.3.31

WordPress>=4.4<4.4.30

WordPress>=4.5<4.5.29

WordPress>=4.6<4.6.26

WordPress>=4.7<4.7.26

WordPress>=4.8<4.8.22

WordPress>=4.9<4.9.23

WordPress>=5.0<5.0.19

WordPress>=5.1<5.1.16

WordPress>=5.2<5.2.18

WordPress>=5.3<5.3.15

WordPress>=5.4<5.4.13

WordPress>=5.5<5.5.12

WordPress>=5.6<5.6.11

WordPress>=5.7<5.7.9

WordPress>=5.8<5.8.7

WordPress>=5.9<5.9.6

WordPress>=6.0<6.0.4

WordPress>=6.1<6.1.2

WordPress=6.2

Remediation

Patch Available

https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=

Event History

May 17, 2023

CVE Published

via MITRE·08:36 AM

Data Sourced

via MITRE·08:36 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Apr 22, 2025

Exploit Published

12:00 AM

Known Exploited

05:57 PM

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-2745.

What is the title of this vulnerability?

The title of this vulnerability is 'WordPress Core is vulnerable to Directory Traversal in versions up to and including 6.2 via the ‘wp_lang’ parameter.'

What is the severity of CVE-2023-2745?