WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
{ "binaries": [ { "binary_name": "wordpress", "binary_version": "4.4.2+dfsg-1ubuntu1" }, { "binary_name": "wordpress-l10n", "binary_version": "4.4.2+dfsg-1ubuntu1" }, { "binary_name": "wordpress-theme-twentyfifteen", "binary_version": "4.4.2+dfsg-1ubuntu1" }, { "binary_name": "wordpress-theme-twentyfourteen", "binary_version": "4.4.2+dfsg-1ubuntu1" }, { "binary_name": "wordpress-theme-twentysixteen", "binary_version": "4.4.2+dfsg-1ubuntu1" } ] }
{ "binaries": [ { "binary_name": "wordpress", "binary_version": "4.9.5+dfsg1-1" }, { "binary_name": "wordpress-l10n", "binary_version": "4.9.5+dfsg1-1" }, { "binary_name": "wordpress-theme-twentyfifteen", "binary_version": "4.9.5+dfsg1-1" }, { "binary_name": "wordpress-theme-twentyseventeen", "binary_version": "4.9.5+dfsg1-1" }, { "binary_name": "wordpress-theme-twentysixteen", "binary_version": "4.9.5+dfsg1-1" } ] }
{ "binaries": [ { "binary_name": "wordpress", "binary_version": "5.3.2+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-l10n", "binary_version": "5.3.2+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-theme-twentynineteen", "binary_version": "5.3.2+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-theme-twentyseventeen", "binary_version": "5.3.2+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-theme-twentysixteen", "binary_version": "5.3.2+dfsg1-1ubuntu1" } ] }
{ "binaries": [ { "binary_name": "wordpress", "binary_version": "5.8.3+dfsg1-1ubuntu1.1" }, { "binary_name": "wordpress-l10n", "binary_version": "5.8.3+dfsg1-1ubuntu1.1" }, { "binary_name": "wordpress-theme-twentynineteen", "binary_version": "5.8.3+dfsg1-1ubuntu1.1" }, { "binary_name": "wordpress-theme-twentytwenty", "binary_version": "5.8.3+dfsg1-1ubuntu1.1" }, { "binary_name": "wordpress-theme-twentytwentyone", "binary_version": "5.8.3+dfsg1-1ubuntu1.1" } ] }
{ "binaries": [ { "binary_name": "wordpress", "binary_version": "6.4.3+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-l10n", "binary_version": "6.4.3+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-theme-twentytwentyfour", "binary_version": "6.4.3+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-theme-twentytwentythree", "binary_version": "6.4.3+dfsg1-1ubuntu1" }, { "binary_name": "wordpress-theme-twentytwentytwo", "binary_version": "6.4.3+dfsg1-1ubuntu1" } ] }