Path traversal in WordPress - CVE-2023-2745
Published: May 18, 2023
Vulnerability identifier: #VU76271
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-2745
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences passed via the "wp_lang" parameter. A remote attacker can send a specially crafted HTTP request and load arbitrary translation files, which can lead to an XSS attack.
Affected software
WordPress
Debian Linux
wordpress (Debian package)
Debian Linux
wordpress (Debian package)
How to mitigate CVE-2023-2745
Install update from vendor's website.
WordPress - addressed in versions 4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2, 6.2.1
wordpress (Debian package) - addressed in versions 5.7.11+dfsg1-0+deb11u1, 6.1.6+dfsg1-0+deb12u1
wordpress (Debian package) - addressed in versions 5.7.11+dfsg1-0+deb11u1, 6.1.6+dfsg1-0+deb12u1
External References
- https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve
- https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=
- http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html