CVE-2023-2745

🗓️ 17 May 2023 08:36:44Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 1109 Views🌐 WEB

WordPress Core Directory Traversal vulnerability in versions up to 6.2 allows unauthenticated attackers to load arbitrary translation files

Reporter	Title	Published	Views	Family All 70
GithubExploit	Exploit for Path Traversal in Wordpress	22 Oct 202521:41	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Wordpress	12 Jun 202313:06	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Wordpress	8 Aug 202403:02	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Wordpress	12 Jun 202313:06	–	githubexploit
0day.today	WordPress Core 6.2 XSS / CSRF / Directory Traversal Vulnerability	19 May 202300:00	–	zdt
ATTACKERKB	CVE-2023-2745	17 May 202309:15	–	attackerkb
Circl	CVE-2023-2745	17 May 202312:31	–	circl
CNNVD	WordPress 路径遍历漏洞	17 May 202300:00	–	cnnvd
Cvelist	CVE-2023-2745 WordPress Core < 6.2.1 - Directory Traversal	17 May 202308:36	–	cvelist
Debian	[SECURITY] [DLA 3462-1] wordpress security update	20 Jun 202322:25	–	debian

NVD

Vulners

Node

wordpress wordpressRange<4.1.38

wordpress wordpressRange4.2–4.2.35

wordpress wordpressRange4.3–4.3.31

wordpress wordpressRange4.4–4.4.30

wordpress wordpressRange4.5–4.5.29

wordpress wordpressRange4.6–4.6.26

wordpress wordpressRange4.7–4.7.26

wordpress wordpressRange4.8–4.8.22

wordpress wordpressRange4.9–4.9.23

wordpress wordpressRange5.0–5.0.19

wordpress wordpressRange5.1–5.1.16

wordpress wordpressRange5.2–5.2.18

wordpress wordpressRange5.3–5.3.15

wordpress wordpressRange5.4–5.4.13

wordpress wordpressRange5.5–5.5.12

wordpress wordpressRange5.6–5.6.11

wordpress wordpressRange5.7–5.7.9

wordpress wordpressRange5.8–5.8.7

wordpress wordpressRange5.9–5.9.6

wordpress wordpressRange6.0–6.0.4

wordpress wordpressRange6.1–6.1.2

wordpress wordpressMatch6.2

[
  {
    "vendor": "WordPress Foundation",
    "product": "WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "4.1.38",
        "versionType": "semver"
      },
      {
        "version": "4.2",
        "status": "affected",
        "lessThan": "4.2.35",
        "versionType": "semver"
      },
      {
        "version": "4.3",
        "status": "affected",
        "lessThan": "4.3.31",
        "versionType": "semver"
      },
      {
        "version": "4.4",
        "status": "affected",
        "lessThan": "4.4.30",
        "versionType": "semver"
      },
      {
        "version": "4.5",
        "status": "affected",
        "lessThan": "4.5.29",
        "versionType": "semver"
      },
      {
        "version": "4.6",
        "status": "affected",
        "lessThan": "4.6.26",
        "versionType": "semver"
      },
      {
        "version": "4.7",
        "status": "affected",
        "lessThan": "4.7.26",
        "versionType": "semver"
      },
      {
        "version": "4.8",
        "status": "affected",
        "lessThan": "4.8.22",
        "versionType": "semver"
      },
      {
        "version": "4.9",
        "status": "affected",
        "lessThan": "4.9.23",
        "versionType": "semver"
      },
      {
        "version": "5.0",
        "status": "affected",
        "lessThan": "5.0.19",
        "versionType": "semver"
      },
      {
        "version": "5.1",
        "status": "affected",
        "lessThan": "5.1.16",
        "versionType": "semver"
      },
      {
        "version": "5.2",
        "status": "affected",
        "lessThan": "5.2.18",
        "versionType": "semver"
      },
      {
        "version": "5.3",
        "status": "affected",
        "lessThan": "5.3.15",
        "versionType": "semver"
      },
      {
        "version": "5.4",
        "status": "affected",
        "lessThan": "5.4.13",
        "versionType": "semver"
      },
      {
        "version": "5.5",
        "status": "affected",
        "lessThan": "5.5.12",
        "versionType": "semver"
      },
      {
        "version": "5.6",
        "status": "affected",
        "lessThan": "5.6.11",
        "versionType": "semver"
      },
      {
        "version": "5.7",
        "status": "affected",
        "lessThan": "5.7.9",
        "versionType": "semver"
      },
      {
        "version": "5.8",
        "status": "affected",
        "lessThan": "5.8.7",
        "versionType": "semver"
      },
      {
        "version": "5.9",
        "status": "affected",
        "lessThan": "5.9.6",
        "versionType": "semver"
      },
      {
        "version": "6.0",
        "status": "affected",
        "lessThan": "6.0.4",
        "versionType": "semver"
      },
      {
        "version": "6.1",
        "status": "affected",
        "lessThan": "6.1.2",
        "versionType": "semver"
      },
      {
        "version": "6.2",
        "status": "affected",
        "lessThan": "6.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f
core	www.core.trac.wordpress.org/changeset
wordpress	www.wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/
wordfence	www.wordfence.com/blog/2023/05/wordpress-core-6-2-1-security-maintenance-release-what-you-need-to-know/
exploit-db	www.exploit-db.com/exploits/52274
lists	www.lists.debian.org/debian-lts-announce/2023/06/msg00024.html
packetstormsecurity	www.packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html

Parameter	Position	Path	Description	CWE
wp_lang	query param	wp-login.php	Directory traversal via wp_lang parameter in WordPress Core enables unauthenticated access to arbitrary translation files and may enable XSS when a crafted translation file is uploaded.	CWE-22

08 Apr 2026 19:18Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.4 - 6.1

EPSS0.79284

SSVC