|Description||WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|bullseye (security), bullseye||5.7.8+dfsg1-0+deb11u2||vulnerable|
The information below is based on the following data on fixed versions.
[bookworm] - wordpress <postponed> (Minor issue, fix along in future update)
[bullseye] - wordpress <postponed> (Minor issue, fix along in future update)