CVE-2023-47679 is a local file inclusion flaw in the Qi Addons For Elementor plugin for WordPress. NVD scores it 6.4, Medium. Versions up to 1.6.3 are affected, and Patchstack lists 1.6.4 as the patched release. Update the plugin as soon as you can.
What's affected
The record lists Qi Addons For Elementor for WordPress, up to and including 1.6.3. Patchstack's entry gives 1.6.3 as the last vulnerable version and 1.6.4 as the first patched one. It records the required privilege as Contributor.
The record describes a path traversal that allows PHP local file inclusion. NVD scores it 6.4, Medium, with a High attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L). Patchstack gives the same 6.4 and a Low priority, and notes the issue is unlikely to be exploited. The two agree on the score.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get qi-addons-for-elementor --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=qi-addons-for-elementor --fields=name,version,status
Anything at or below 1.6.3 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update Qi Addons For Elementor to 1.6.4 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Review the Contributor accounts on the site and remove ones you do not need, since Patchstack lists that role as the one required.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. Patchstack names the result a local file inclusion, which it describes as letting an attacker make the site load server files it should not, sometimes leading to takeover.
A local file inclusion in a PHP plugin is more serious than its 6.4 score might suggest, because included files are executed as PHP. What holds the score down is the need for a Contributor account and a High attack complexity. If your site gives that role to many users, raise the priority of the update.
The pattern is a path built from a request value. The fix is to validate the value against a fixed list, or to resolve the path and confirm it stays in the intended folder. The plugin author shipped the fix in 1.6.4.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-47679 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Why is this only Medium if files can be included?
The attacker needs a Contributor account, and the attack complexity is High, per the NVD vector.
Sources
Last reviewed: 19 October 2026.
