CVE-2023-2745: WordPress Core wp_lang parameter directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh EPSS and a public exploit raise the risk despite the medium CVSS score and lack of KEV listing.

What it is

WordPress Core versions up to and including 6.2 are vulnerable to directory traversal via the 'wp_lang' parameter, allowing unauthenticated attackers to access and load arbitrary translation files. If an attacker can upload a crafted translation file, the flaw can also be used to perform cross-site scripting.

Impact

An unauthenticated attacker can read arbitrary files on the server and, if a crafted translation file is present, execute cross-site scripting in the context of the site.

Attack surface

Reachable over the network without authentication or user interaction by manipulating the 'wp_lang' parameter; the XSS variant requires the ability to upload a crafted translation file, such as through an upload form.

Exploitation

Not listed in CISA KEV, but EPSS is 0.795 (99.6th percentile) and a public Exploit-DB entry exists, indicating high likelihood of exploitation.

What to do

• Update WordPress Core to version 6.2.1 or later.
• Apply the vendor patch referenced in the WordPress changeset.
• Restrict or monitor file upload functionality to prevent crafted translation files.
• Validate and sanitize the 'wp_lang' parameter on any custom or legacy code paths.

Detection

• Monitor web server logs for requests with suspicious 'wp_lang' parameter values containing path traversal sequences.
• Alert on unexpected file reads or inclusion of translation files from outside expected directories.
• Detect uploads of translation files (.mo, .po) to non-standard locations or by unauthenticated users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.