CVE-2023-2745
mediumpriority · track · 38EPSS 0.794 · 100 %ileexploit · PoCDEEUUSEPSS · scored 2026-10-27
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- EDB-52274WordPress Core 6.2 - Directory TraversalPoC · exploit_db
- fofovicfof-ai/cve-2023-2745cve-2023-2745PoC · poc_in_github
affected products (91)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-1231WordPress: Mehrere SchwachstellenDeutsch2023-05-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in WordPress ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, einen CSRF-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.
- BIT-wordpress-2023-2745WordPress Core < 6.2.1 - Directory Traversal2024-03-06vendor · osvUS
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
- BIT-wordpress-multisite-2023-2745WordPress Core < 6.2.1 - Directory Traversal2024-03-06vendor · osvUS
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
also known as (5)
Other names and identifiers for this entity.
- CNNVD-202305-1720cnnvd
- EUVD-2023-34206enisa_euvd
- GHSA-xgqr-2mpj-w9qvenisa_euvd
- BIT-wordpress-2023-2745osv
- BIT-wordpress-multisite-2023-2745osv
sources
Which sources assert this record, and when.
references (18)
External citations — patches, advisories, analysis.
- https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=cnnvd
- https://cxsecurity.com/issue/WLB-2023050040cnnvd
- https://lists.debian.org/debian-lts-announce/2023/06/msg00024.htmlcnnvd
- https://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.htmlcnnvd
- https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/cnnvd
- https://www.exploit-db.com/exploits/52274cnnvd
- https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cvecnnvd
- https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan