WordPress Core < 6.2.1 - Directory Traversal

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• wordpress wordpressbefore 4.1.38
• wordpress wordpress4.2 and later · before 4.2.35
• wordpress wordpress4.3 and later · before 4.3.31
• wordpress wordpress4.4 and later · before 4.4.30
• wordpress wordpress4.5 and later · before 4.5.29
• wordpress wordpress4.6 and later · before 4.6.26
• wordpress wordpress4.7 and later · before 4.7.26
• wordpress wordpress4.8 and later · before 4.8.22
• wordpress wordpress4.9 and later · before 4.9.23
• wordpress wordpress5.0 and later · before 5.0.19
• wordpress wordpress5.1 and later · before 5.1.16
• wordpress wordpress5.2 and later · before 5.2.18
• wordpress wordpress5.3 and later · before 5.3.15
• wordpress wordpress5.4 and later · before 5.4.13
• wordpress wordpress5.5 and later · before 5.5.12
• wordpress wordpress5.6 and later · before 5.6.11
• wordpress wordpress5.7 and later · before 5.7.9
• wordpress wordpress5.8 and later · before 5.8.7
• wordpress wordpress5.9 and later · before 5.9.6
• wordpress wordpress6.0 and later · before 6.0.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Wordfence). Independent of NVD's CPE analysis and usually ahead of it.

• WordPress Foundation WordPress

  • before 4.1.38affected · semver
  • 4.2 and later · before 4.2.35affected · semver
  • 4.3 and later · before 4.3.31affected · semver
  • 4.4 and later · before 4.4.30affected · semver
  • 4.5 and later · before 4.5.29affected · semver
  • 4.6 and later · before 4.6.26affected · semver
  • 4.7 and later · before 4.7.26affected · semver
  • 4.8 and later · before 4.8.22affected · semver
  • 4.9 and later · before 4.9.23affected · semver
  • 5.0 and later · before 5.0.19affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the KEV
  74This week
• CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionKEV
  72This week
• CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryKEV
  60This week

Published before and after this one in the same product

• ← EarlierCVE-2022-3590Dec 14, 2022 · WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
  24Monitor
• ← EarlierCVE-2023-22622Jan 4, 2023 · WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the so
  22Monitor
• Later →CVE-2023-38000Oct 13, 2023 · Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.