Skip to content
Fencer Vulns
medium 6.1

CVE-2023-2745 json

WordPress Core < 6.2.1 - Directory Traversal

published 2023-05-17 3 y ago modified 2026-09-08 2 mo ago also BIT-wordpress-2023-2745 , BIT-wordpress-multisite-2023-2745 , EUVD-2023-34206

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
79.7%
EPSS 79.7% chance of exploitation in 30 days, percentile 99.6%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Patch / fix

  • bitnami wordpress 4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2, 6.2.1
  • bitnami wordpress-multisite 4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2, 6.2.1
  • WordPress Foundation WordPress 4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4
  • wordpress Debian 12 6.1.6+dfsg1-0+deb12u1
  • wordpress Debian 14, Debian 13 6.2.1+dfsg1-1

debian advisories DEBIAN-CVE-2023-2745

Timeline

  1. Published
  2. First public exploit (EDB-52274)

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

79.66% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52274 WordPress Core 6.2 - Directory Traversal webapps, 2025-04-22
  • Nuclei template WordPress Core <=6.2 - Directory Traversal nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami wordpress
<4.1.38
>=4.2.0, <4.2.35
>=4.3.0, <4.3.31
>=4.4.0, <4.4.30
>=4.5.0, <4.5.29
>=4.6.0, <4.6.26
>=4.7.0, <4.7.26
>=4.8.0, <4.8.22
>=4.9.0, <4.9.23
>=5.0.0, <5.0.19
>=5.1.0, <5.1.16
>=5.2.0, <5.2.18
>=5.3.0, <5.3.15
>=5.4.0, <5.4.13
>=5.5.0, <5.5.12
>=5.6.0, <5.6.11
>=5.7.0, <5.7.9
>=5.8.0, <5.8.7
>=5.9.0, <5.9.6
>=6.0.0, <6.0.4
>=6.1.0, <6.1.2
>=6.2.0, <6.2.1
4.1.38
4.2.35
4.3.31
4.4.30
4.5.29
4.6.26
4.7.26
4.8.22
4.9.23
5.0.19
5.1.16
5.2.18
5.3.15
5.4.13
5.5.12
5.6.11
5.7.9
5.8.7
5.9.6
6.0.4
6.1.2
6.2.1
bitnami wordpress-multisite
<4.1.38
>=4.2.0, <4.2.35
>=4.3.0, <4.3.31
>=4.4.0, <4.4.30
>=4.5.0, <4.5.29
>=4.6.0, <4.6.26
>=4.7.0, <4.7.26
>=4.8.0, <4.8.22
>=4.9.0, <4.9.23
>=5.0.0, <5.0.19
>=5.1.0, <5.1.16
>=5.2.0, <5.2.18
>=5.3.0, <5.3.15
>=5.4.0, <5.4.13
>=5.5.0, <5.5.12
>=5.6.0, <5.6.11
>=5.7.0, <5.7.9
>=5.8.0, <5.8.7
>=5.9.0, <5.9.6
>=6.0.0, <6.0.4
>=6.1.0, <6.1.2
>=6.2.0, <6.2.1
4.1.38
4.2.35
4.3.31
4.4.30
4.5.29
4.6.26
4.7.26
4.8.22
4.9.23
5.0.19
5.1.16
5.2.18
5.3.15
5.4.13
5.5.12
5.6.11
5.7.9
5.8.7
5.9.6
6.0.4
6.1.2
6.2.1

Affected products

  • WordPress Foundation WordPress

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.