5.4
Moyenne
CVE-2023-2745 WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter
Description
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WordPress 6.2 | 6.2 → < 6.2.1 | 6.2.1 |
| WordPress 6.1 | 6.1 → < 6.1.2 | 6.1.2 |
| WordPress 6.0 | 6.0 → < 6.0.4 | 6.0.4 |
| WordPress 5.9 | 5.9 → < 5.9.6 | 5.9.6 |
| WordPress 5.8 | 5.8 → < 5.8.7 | 5.8.7 |
| WordPress 5.7 | 5.7 → < 5.7.9 | 5.7.9 |
| WordPress 5.6 | 5.6 → < 5.6.11 | 5.6.11 |
| WordPress 5.5 | 5.5 → < 5.5.12 | 5.5.12 |
| WordPress 5.4 | 5.4 → < 5.4.13 | 5.4.13 |
Afficher les 13 autres branches Masquer les 13 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WordPress 5.3 | 5.3 → < 5.3.15 | 5.3.15 |
| WordPress 5.2 | 5.2 → < 5.2.18 | 5.2.18 |
| WordPress 5.1 | 5.1 → < 5.1.16 | 5.1.16 |
| WordPress 5.0 | 5.0 → < 5.0.19 | 5.0.19 |
| WordPress 4.9 | 4.9 → < 4.9.23 | 4.9.23 |
| WordPress 4.8 | 4.8 → < 4.8.22 | 4.8.22 |
| WordPress 4.7 | 4.7 → < 4.7.26 | 4.7.26 |
| WordPress 4.6 | 4.6 → < 4.6.26 | 4.6.26 |
| WordPress 4.5 | 4.5 → < 4.5.29 | 4.5.29 |
| WordPress 4.4 | 4.4 → < 4.4.30 | 4.4.30 |
| WordPress 4.3 | 4.3 → < 4.3.31 | 4.3.31 |
| WordPress 4.2 | 4.2 → < 4.2.35 | 4.2.35 |
| WordPress 4.1 | premières → < 4.1.38 | 4.1.38 |
Références
- www.wordfence.com www.wordfence.com
- wordpress.org wordpress.org
- core.trac.wordpress.org core.trac.wordpress.org
- www.wordfence.com www.wordfence.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de WordPress
Les 8 CVE de WordPress →
CVE-2026-119977
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
8.1
Élevée
CVE-2026-114570
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2…
4.9
Moyenne
CVE-2026-3906
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1
4.3
Moyenne
CVE-2022-4973
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be…
4.9
Moyenne