CVE-2023-47504 is a broken access control flaw in the Elementor Website Builder plugin for WordPress. NVD scores it 6.5, Medium. Versions up to 3.16.4 are affected, and Patchstack lists 3.16.5 as the patched release. Update the plugin as soon as you can.
What's affected
The record lists Elementor Website Builder for WordPress, up to and including 3.16.4. Patchstack's entry gives 3.16.4 as the last vulnerable version and 3.16.5 as the first patched one. It records the required privilege as Contributor.
Patchstack's title for this entry is a contributor arbitrary attachment read. The NVD description is improper authentication, accessing functionality not properly constrained by ACLs, with a confidentiality impact only (C:H, I:N, A:N).
Source note on severity: NVD scores it 6.5, Medium. Patchstack gives the same CVSS of 6.5 but sets its own priority as Low, with the note that the issue is unlikely to be exploited. The two do not conflict on the score, and they differ on how likely exploitation is.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get elementor --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=elementor --fields=name,version,status
Anything at or below 3.16.4 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update Elementor Website Builder to 3.16.5 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Review the Contributor accounts on the site. Patchstack lists Contributor as the privilege needed, so remove accounts you do not recognise and do not give the role to people who do not need it.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
The record lists CWE-287, improper authentication, but Patchstack classifies the issue as broken access control. In practice the plugin let a signed-in user with the Contributor role reach attachment data that role should not reach. Contributors can write posts but cannot upload files in a standard WordPress setup, so attachments belong to others.
Elementor is installed on a very large number of sites, so even a Medium score with a low privilege needs one account. If your site lets visitors register and assigns Contributor by default, that bar is low. If only your team holds accounts, the exposure is smaller.
The fix in 3.16.5 is a point release, and Elementor is updated often. Keep automatic updates on for it if your change process allows.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-47504 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Does a visitor with no account need to worry?
Patchstack lists Contributor as the required privilege, so an account with that role is needed.
Sources
Last reviewed: 19 October 2026.
