CVE-2023-47178 is a high severity path traversal flaw in The Plus Addons for Elementor Pro through version 5.2.8, scored 8.6. It allows PHP local file inclusion, and the reference describes it as unauthenticated. Update to a version later than 5.2.8, and disable the plugin if you cannot.
What's affected
The record says The Plus Addons for Elementor Pro from n/a through 5.2.8 is affected. It names the problem as improper limitation of a pathname to a restricted directory, which allows PHP local file inclusion. The reference is a Patchstack database entry whose address describes it as an unauthenticated local file inclusion in version 5.2.8.
I could not read the Patchstack page, since the request was blocked, so I cannot confirm the first fixed version from the source. The record's wording means that every release up to and including 5.2.8 is affected. Check the plugin changelog and your vendor account for the first release after 5.2.8, and do not guess at a version number.
The score is 8.6 with a network vector, no privileges required and no user interaction.
The NVD record was published on 2024-05-17, scores 8.6 (High), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. Weakness class: CWE-22.
How to check if you're exposed
Check the plugin version on each WordPress site you run.
wp plugin list --fields=name,status,version | grep -i plus
You can also open the Plugins page in the WordPress admin and read the version under The Plus Addons for Elementor Pro. Anything at or below 5.2.8 is affected. Since this is a premium plugin, sites often lag on updates because the licensing is separate from the WordPress plugin directory. Check agency managed and client sites too.
What to do now
- List every WordPress site that uses The Plus Addons for Elementor Pro.
- Update to the newest version from the vendor, which is later than 5.2.8.
- If you cannot update right away, deactivate the plugin or the features that rely on it.
- Review web logs for requests with path traversal patterns aimed at the plugin's endpoints.
- Turn on automatic updates for plugins you rely on, and monitor for new advisories.
Why it matters
Path traversal, CWE-22, lets input reach files outside the folder the code meant to use. When the result goes into a PHP include call, the server reads the file and may run it as code. That is why a local file inclusion bug is more serious than a plain file read.
Add the fact that no login is needed and the flaw is open to anyone who can reach the site. Plugin bugs like this are used at scale, because WordPress sites are easy to find. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
For site owners, the useful habit is simple: track plugin versions the same way you track libraries.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
I could not confirm one. The record says through 5.2.8, so use a release later than that and check the vendor changelog.
Sources
Last reviewed: 19 October 2026.
