CVE-2023-2745
MEDIUM EXPLOITED NUCLEIWordPress < 6.2 - Unauthenticated Directory Traversal via wp_lang Parameter
Title source: llmExploitation Summary
CVE-2023-2745 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Milad karimi, fofovicfof-ai. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages a directory traversal vulnerability in WordPress Core 6.2 by manipulating the 'wp_lang' parameter to access arbitrary files, such as '/etc/passwd'. It sends a crafted HTTP request and checks the response for successful file access.
Description
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
Exploits (2)
This exploit leverages a directory traversal vulnerability in WordPress Core 6.2 by manipulating the 'wp_lang' parameter to access arbitrary files, such as '/etc/passwd'. It sends a crafted HTTP request and checks the response for successful file access.
This repository contains a Python script that checks for the presence of CVE-2023-2745, a directory traversal vulnerability in WordPress versions ≤ 6.2. The script attempts to exploit the vulnerability by probing for /etc/passwd via the wp_lang parameter but does not execute arbitrary code.
Nuclei Templates (1)
References (7)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N