PT-2023-21137 · WordPress · Wordpress

Matt Rusnak + 2 · Published 2023-05-17 · Updated 2024-05-08 · CVE-2023-2745

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Core versions up to, and including, 6.2

Description The issue allows unauthenticated attackers to access and load arbitrary translation files via the wp lang parameter, potentially leading to a Cross-Site Scripting attack if a crafted translation file is uploaded to the site.

Recommendations For WordPress Core versions up to, and including, 6.2, consider restricting access to the wp lang parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using upload forms that could allow attackers to upload crafted translation files.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-WORDPRESS-2023-2745

BIT-WORDPRESS-MULTISITE-2023-2745

CVE-2023-2745

DLA-3462-1

DSA-5685-1

Affected Products

Wordpress

References · 22

• 🔥 https://exploit-db.com/exploits/52274 · Exploit
• https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-2745 · Security Note
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2023-2745 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3462-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2745 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2745 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2745 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-2745 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5685-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2023-2745 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-2745 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-2745 · Security Note
• https://t.me/cvenotify/50679 · Telegram Post
• https://t.me/cvenotify/52754 · Telegram Post