Medium severity5.4NVD Advisory· Published May 17, 2023· Updated Apr 8, 2026
CVE-2023-2745
CVE-2023-2745
Description
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
Affected products
2cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <4.1.38
- cpe:2.3:a:wordpress:wordpress:6.2:*:*:*:*:*:*:*
Patches
21206b164e27d385ae754b890202242f4554cb2e33df0588ffc129defefef8c12fc446e7d2eb5a504bda5f7e6cddf8dd03dde4da7b797c0cac57854d9be6664bb77aa195b6583c2bca18a1be2684e064da002d598defb471e7258d2876d269e6e761abfb66115c61d5032484dd21e34a51aa55527210254519ece2b5f087bcVulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- core.trac.wordpress.org/changesetnvdPatch
- packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.htmlnvdThird Party AdvisoryVDB Entry
- www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358fnvdThird Party Advisory
- wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/nvdRelease Notes
- lists.debian.org/debian-lts-announce/2023/06/msg00024.htmlnvd
- www.exploit-db.com/exploits/52274nvd
- www.wordfence.com/blog/2023/05/wordpress-core-6-2-1-security-maintenance-release-what-you-need-to-know/nvd
News mentions
0No linked articles in our index yet.