6.1

CVE-2023-2745

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wordpress ≫ Wordpress Version < 4.1.38
Wordpress ≫ Wordpress Version >= 4.2 < 4.2.35
Wordpress ≫ Wordpress Version >= 4.3 < 4.3.31
Wordpress ≫ Wordpress Version >= 4.4 < 4.4.30
Wordpress ≫ Wordpress Version >= 4.5 < 4.5.29
Wordpress ≫ Wordpress Version >= 4.6 < 4.6.26
Wordpress ≫ Wordpress Version >= 4.7 < 4.7.26
Wordpress ≫ Wordpress Version >= 4.8 < 4.8.22
Wordpress ≫ Wordpress Version >= 4.9 < 4.9.23
Wordpress ≫ Wordpress Version >= 5.0 < 5.0.19
Wordpress ≫ Wordpress Version >= 5.1 < 5.1.16
Wordpress ≫ Wordpress Version >= 5.2 < 5.2.18
Wordpress ≫ Wordpress Version >= 5.3 < 5.3.15
Wordpress ≫ Wordpress Version >= 5.4 < 5.4.13
Wordpress ≫ Wordpress Version >= 5.5 < 5.5.12
Wordpress ≫ Wordpress Version >= 5.6 < 5.6.11
Wordpress ≫ Wordpress Version >= 5.7 < 5.7.9
Wordpress ≫ Wordpress Version >= 5.8 < 5.8.7
Wordpress ≫ Wordpress Version >= 5.9 < 5.9.6
Wordpress ≫ Wordpress Version >= 6.0 < 6.0.4
Wordpress ≫ Wordpress Version >= 6.1 < 6.1.2
Wordpress ≫ Wordpress Version6.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 66.38% 0.985
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security@wordfence.com 5.4 2.2 2.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.