CVE-2023-2745WordPress Core < 6.2.1 - Directory Traversal
- 5.4MediumCVSS base score
- 79.7%Exploitation in 30 daysEPSS · top 0.4% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 2Public exploitsMetasploit, Nuclei and Exploit-DB
Description
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Nuclei template and an Exploit-DB entry for it.
Show the exploits2
Nuclei templates1 template
- WordPress Core <=6.2 - Directory Traversal (Nuclei template) (opens in a new tab)
http/cves/2023/CVE-2023-2745.yamlSeverity medium
Exploit-DB1 entry
- WordPress Core 6.2 - Directory Traversal (Exploit-DB entry) (opens in a new tab)
EDB-ID 52274webapps, phppublished 22 Apr 2025Not verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By Wordfence
- 1 day later
· 1 day later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WordfenceCNA (assigner) | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 79.7% · top 0.4% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.
Affected products
WordPress Foundation · WordPress
- affected < 4.1.38
- affected 4.2 – < 4.2.35
- affected 4.3 – < 4.3.31
- affected 4.4 – < 4.4.30
- affected 4.5 – < 4.5.29
- affected 4.6 – < 4.6.26
- affected 4.7 – < 4.7.26
- affected 4.8 – < 4.8.22
- affected 4.9 – < 4.9.23
- affected 5.0 – < 5.0.19
- affected 5.1 – < 5.1.16
- affected 5.2 – < 5.2.18
- affected 5.3 – < 5.3.15
- affected 5.4 – < 5.4.13
- affected 5.5 – < 5.5.12
- affected 5.6 – < 5.6.11
- affected 5.7 – < 5.7.9
- affected 5.8 – < 5.8.7
- affected 5.9 – < 5.9.6
- affected 6.0 – < 6.0.4
- affected 6.1 – < 6.1.2
- affected 6.2 – < 6.2.1
References
References7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve (opens in a new tab)x_transferred
- https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ (opens in a new tab)x_transferred
- https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= (opens in a new tab)x_transferred
- https://www.wordfence.com/blog/2023/05/wordpress-core-6-2-1-security-maintenance-release-what-you-need-to-know/ (opens in a new tab)
- https://www.exploit-db.com/exploits/52274 (opens in a new tab)
- http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2023-34206 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2023-2745)Record last updated .