WordPress core

CVE-2023-2745

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Severity: Medium 5.4
Published: 17 May 2023
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2
Sources: NVD

Affected software

Software Affected versions

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	Version 6.2 From 6.1 before 6.1.2 From 6.0 before 6.0.4 From 5.9 before 5.9.6 All 22 release lines Every version before 4.1.38 From 4.2 before 4.2.35 From 4.3 before 4.3.31 From 4.4 before 4.4.30 From 4.5 before 4.5.29 From 4.6 before 4.6.26 From 4.7 before 4.7.26 From 4.8 before 4.8.22 From 4.9 before 4.9.23 From 5.0 before 5.0.19 From 5.1 before 5.1.16 From 5.2 before 5.2.18 From 5.3 before 5.3.15 From 5.4 before 5.4.13 From 5.5 before 5.5.12 From 5.6 before 5.6.11 From 5.7 before 5.7.9 From 5.8 before 5.8.7 From 5.9 before 5.9.6 From 6.0 before 6.0.4 From 6.1 before 6.1.2 Version 6.2

WordPressWordPress core · cpe:a:wordpress:wordpress

Version 6.2
From 6.1 before 6.1.2
From 6.0 before 6.0.4
From 5.9 before 5.9.6

All 22 release lines

Every version before 4.1.38
From 4.2 before 4.2.35
From 4.3 before 4.3.31
From 4.4 before 4.4.30
From 4.5 before 4.5.29
From 4.6 before 4.6.26
From 4.7 before 4.7.26
From 4.8 before 4.8.22
From 4.9 before 4.9.23
From 5.0 before 5.0.19
From 5.1 before 5.1.16
From 5.2 before 5.2.18
From 5.3 before 5.3.15
From 5.4 before 5.4.13
From 5.5 before 5.5.12
From 5.6 before 5.6.11
From 5.7 before 5.7.9
From 5.8 before 5.8.7
From 5.9 before 5.9.6
From 6.0 before 6.0.4
From 6.1 before 6.1.2
Version 6.2

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2023-2745
CVE.org https://www.cve.org/CVERecord?id=CVE-2023-2745