CVE-2023-2745

NameCVE-2023-2745
DescriptionWordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3462-1, DSA-5685-1
Debian Bugs1036296

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wordpress (PTS)buster5.0.15+dfsg1-0+deb10u1vulnerable
buster (security)5.0.21+dfsg1-0+deb10u1fixed
bullseye5.7.8+dfsg1-0+deb11u2vulnerable
bullseye (security)5.7.11+dfsg1-0+deb11u1fixed
bookworm6.1.1+dfsg1-1vulnerable
bookworm (security)6.1.6+dfsg1-0+deb12u1fixed
trixie6.5.2+dfsg1-1fixed
sid6.5.3+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wordpresssourcebuster5.0.19+dfsg1-0+deb10u1DLA-3462-1
wordpresssourcebullseye5.7.11+dfsg1-0+deb11u1DSA-5685-1
wordpresssourcebookworm6.1.6+dfsg1-0+deb12u1DSA-5685-1
wordpresssource(unstable)6.2.1+dfsg1-11036296

Notes

https://core.trac.wordpress.org/changeset?old=55765&new=55765
https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/

Search for package or bug name: Reporting problems