What is CVE-2023-2278?

CVE-2023-2278 is a critical-severity vulnerability in Wpdirectorykit Wp Directory Kit, classified under Path Traversal. CVSS score: 9.8/10. Published 2023-06-13.

How severe is CVE-2023-2278?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2023-2278 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Wpdirectorykit Wp Directory Kit

CVE-2023-2278

The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2023-06-13 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.017 (76.1th percentile), scored 2026-09-27.

Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 76.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000

Affected products

Wpdirectorykit Wp Directory Kit — versions 0
Wpdirectorykit Wp Directory Kit

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

20142995/nuclei-templates

References

www.wordfence.com/threat-intel/vulnerabilities/id/87399a07-d2d8-42cd-81f0-9060f… (Third Party Advisory)
plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/vendor/Winter_MVC/… (Exploit)
plugins.trac.wordpress.org/changeset/2904689/wpdirectorykit/trunk/vendor/Winter… (Patch, Release Notes)

Frequently asked questions

What is CVE-2023-2278?: CVE-2023-2278 is a critical-severity vulnerability in Wpdirectorykit Wp Directory Kit, classified under Path Traversal. CVSS score: 9.8/10. Published 2023-06-13.
How severe is CVE-2023-2278?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2023-2278 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.