p PatchFirst

CVE-2023-2745

CVE-2023-2745 · WordPress Core < 6.2.1 - Directory Traversal

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

CVSS 5.4 · Medium · EPSS 79.4% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • wordpress

    Versions
    • ≥ 0, < 4.1.38: Affected (semver)
    • ≥ 4.2, < 4.2.35: Affected (semver)
    • ≥ 4.3, < 4.3.31: Affected (semver)
    • ≥ 4.4, < 4.4.30: Affected (semver)
    • ≥ 4.5, < 4.5.29: Affected (semver)
    • ≥ 4.6, < 4.6.26: Affected (semver)
    • ≥ 4.7, < 4.7.26: Affected (semver)
    • ≥ 4.8, < 4.8.22: Affected (semver)
    • ≥ 4.9, < 4.9.23: Affected (semver)
    • ≥ 5.0, < 5.0.19: Affected (semver)
    • ≥ 5.1, < 5.1.16: Affected (semver)
    • ≥ 5.2, < 5.2.18: Affected (semver)
    • ≥ 5.3, < 5.3.15: Affected (semver)
    • ≥ 5.4, < 5.4.13: Affected (semver)
    • ≥ 5.5, < 5.5.12: Affected (semver)
    • ≥ 5.6, < 5.6.11: Affected (semver)
    • ≥ 5.7, < 5.7.9: Affected (semver)
    • ≥ 5.8, < 5.8.7: Affected (semver)
    • ≥ 5.9, < 5.9.6: Affected (semver)
    • ≥ 6.0, < 6.0.4: Affected (semver)
    • ≥ 6.1, < 6.1.2: Affected (semver)
    • ≥ 6.2, < 6.2.1: Affected (semver)

    Update to 4.1.38; Update to 4.2.35; Update to 4.3.31; Update to 4.4.30; Update to 4.5.29; Update to 4.6.26; Update to 4.7.26; Update to 4.8.22; Update to 4.9.23; Update to 5.0.19; Update to 5.1.16; Update to 5.2.18; Update to 5.3.15; Update to 5.4.13; Update to 5.5.12; Update to 5.6.11; Update to 5.7.9; Update to 5.8.7; Update to 5.9.6; Update to 6.0.4; Update to 6.1.2; Update to 6.2.1

  • wordpress Debian:12

    Versions
    • 6.1.1+dfsg1-1
    Affected ranges
    • ECOSYSTEM: < 6.1.6+dfsg1-0+deb12u1

    Update to 6.1.6+dfsg1-0+deb12u1

  • wordpress Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.2.1+dfsg1-1

    Update to 6.2.1+dfsg1-1

  • wordpress Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.2.1+dfsg1-1

    Update to 6.2.1+dfsg1-1

  • wordpress Ubuntu:16.04:LTS

    Versions
    • 4.3+dfsg-1
    • 4.3.1+dfsg-1
    • 4.4+dfsg-1
    • 4.4.1+dfsg-1
    • 4.4.2+dfsg-1
    • 4.4.2+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:18.04:LTS

    Versions
    • 4.8.2+dfsg-2
    • 4.8.3+dfsg-1
    • 4.9.1+dfsg-1
    • 4.9.2+dfsg-1
    • 4.9.4+dfsg-1
    • 4.9.5+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:20.04:LTS

    Versions
    • 5.2.2+dfsg1-1
    • 5.2.4+dfsg1-1
    • 5.3.2+dfsg1-1
    • 5.3.2+dfsg1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:22.04:LTS

    Versions
    • 5.7.1+dfsg1-2ubuntu1
    • 5.8.1+dfsg1-2ubuntu1
    • 5.8.2+dfsg1-1ubuntu1
    • 5.8.3+dfsg1-1ubuntu1
    • 5.8.3+dfsg1-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:24.04:LTS

    Versions
    • 6.2+dfsg1-1ubuntu1
    • 6.4.3+dfsg1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →