CVE-2023-47188 is a medium severity broken access control flaw (CVSS 5.3) in the Simple Job Board plugin for WordPress. Versions up to and including 2.10.5 are affected. Patchstack lists 2.10.6 as the patched version, so update the plugin to 2.10.6 or later.
What's affected
The CVE record says Simple Job Board versions from n/a through 2.10.5 are affected. Patchstack lists the vulnerable versions as 2.10.5 and below and the patched version as 2.10.6. Its entry is dated 3 November 2023 and rates the issue as low priority with no impactful threat.
The vector in the record is a network attack with no login and low complexity, and a limited effect on integrity.
How to check if you're exposed
With WP-CLI, read the version of the plugin on each site:
wp plugin get simple-job-board --field=version
wp plugin list --name=simple-job-board --fields=name,version,update
Or open the Plugins page in the WordPress dashboard. Versions at 2.10.5 or below are in range.
If you run a fleet of WordPress sites, keep a plugin inventory and recheck it on a schedule, since advisories for plugins arrive constantly and often a year or more after the release they affect. Continuous monitoring of your inventory against new CVEs turns that into a short list instead of a manual hunt.
What to do now
- Check the plugin version on each site where a careers page uses it.
- Update to 2.10.6 or later, and check that the job listing and application forms still work.
- Remove the plugin from sites that no longer use it, because inactive plugins still ship code.
- Review which user roles can manage job applications and applicants' data.
- Add the plugin to your inventory so future advisories find it quickly.
Why it matters
The class is missing authorization (CWE-862). A request handler does the work without confirming that the caller has permission. WordPress provides capability checks for exactly this purpose, and plugin bugs of this type usually mean one of those checks was left out of one handler.
Patchstack rates the issue low priority and unlikely to be exploited, and the score of 5.3 reflects a small integrity effect with no data disclosure. A job board plugin may hold applicant details, so access control mistakes deserve a fix even when the headline score is modest. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Simple Job Board 2.10.6, according to Patchstack.
Can I skip it because it is low priority?
You can schedule it, but updates are cheap, and applicant data makes access control worth keeping tidy.
Sources
Last reviewed: 19 October 2026.
