CVE-2023-2745

WordPress Core < 6.2.1 - Directory Traversal

MEDIUM

5.4

CVSS Score

Published: May 17, 2023 at 08:36 AM UTC

Updated: June 17, 2026 at 05:53 AM UTC

1 product affected across 1 vendorWordPress

Using WordPress by WordPress Foundation?

Get instant alerts when new vulnerabilities affect WordPress - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.4

Exploit prediction

EPSS 79%

SSVC

No known exploit

Description

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

WordPress · WordPressdrupal

95%

v < 4.1.384.2 ≤ v < 4.2.354.3 ≤ v < 4.3.314.4 ≤ v < 4.4.304.5 ≤ v < 4.5.294.6 ≤ v < 4.6.264.7 ≤ v < 4.7.264.8 ≤ v < 4.8.224.9 ≤ v < 4.9.235.0 ≤ v < 5.0.195.1 ≤ v < 5.1.165.2 ≤ v < 5.2.185.3 ≤ v < 5.3.155.4 ≤ v < 5.4.135.5 ≤ v < 5.5.125.6 ≤ v < 5.6.115.7 ≤ v < 5.7.95.8 ≤ v < 5.8.75.9 ≤ v < 5.9.66.0 ≤ v < 6.0.46.1 ≤ v < 6.1.26.2 ≤ v < 6.2.14.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 5.0 5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8 5.9 6.0 6.1 6.2

Affected range stops below 4.1.38, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.2.35, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.31, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.30, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5.29, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.26, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.7.26, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.8.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.9.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.0.19, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.1.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.2.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.3.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.4.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.5.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.6.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.7.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.8.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.9.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=

References (7)

Third Party AdvisoryVDB Entry

Source: [email protected]

http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html

Patch

Source: [email protected]

https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=

Source: [email protected]

https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html

Release Notes

Source: [email protected]

https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/

Third Party Advisory

Source: [email protected]

https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/52274

Source: cverecord

https://www.wordfence.com/blog/2023/05/wordpress-core-6-2-1-security-maintenance-release-what-you-need-to-know/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.4MEDIUMWordfence

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card