What is CVE-2023-2745?

CVE-2023-2745 is a medium-severity vulnerability affecting WordPress Core versions up to and including 6.2. This issue involves directory traversal via the 'wp_lang' parameter, allowing unauthenticated attackers to access and load arbitrary translation files. In certain cases, this vulnerability could also be exploited to perform a Cross-Site Scripting attack. Websites running vulnerable versions of WordPress Core should take appropriate action to address this issue.

Who is impacted by this?

Users of WordPress Core versions up to and including 6.2 are impacted by CVE-2023-2745. This vulnerability allows unauthenticated attackers to access and load arbitrary translation files through the 'wp_lang' parameter, potentially leading to a Cross-Site Scripting attack. It is important to be aware of this vulnerability and take necessary precautions to protect your website.

What should I do if I’m affected?

If you're affected by the CVE-2023-2745 vulnerability, it's crucial to take action to protect your website or web application. Here's what you should do:

1. Update to WordPress Core version 6.2.1, which contains patches for the vulnerabilities. See the WordPress 6.2.1 Maintenance & Security Release for more information.

2. Verify that your site has been automatically updated to one of the patched versions. If not, update manually as soon as possible.

3. Ensure that you are running a version of WordPress greater than 4.1 to avoid compatibility issues.

4. Regularly check for and apply security updates to your system. Keep track of security advisories and updates from official sources, such as the Debian LTS security advisories and the WordPress security tracker page.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2023-2745 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This medium-severity issue, known as Directory Traversal, affects WordPress Core versions up to and including 6.2. It was added to the National Vulnerability Database on May 17, 2023. Users should update to WordPress Core version 6.2.1 to address this vulnerability.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-22, which involves improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• WordPress Core 6.2 XSS CSRF Directory Traversal ≈ Packet Storm

• Changeset 58377 – WordPress Trac

• SECURITY [DLA 3462-1] wordpress security update

• WordPress 6.2.1 Maintenance & Security Release – WordPress News