CVE-2023-47760 is a missing authorization flaw in the Essential Blocks for Gutenberg plugin for WordPress. NVD scores it 4.3, Medium. Versions up to 4.2.0 are affected, and Patchstack lists 4.2.1 as the patched release. Update the plugin as soon as you can.
What's affected
The record lists Essential Blocks for Gutenberg for WordPress, up to and including 4.2.0. Patchstack's entry gives 4.2.0 as the last vulnerable version and 4.2.1 as the first patched one. It records the required privilege as Subscriber.
NVD scores this 4.3, Medium. Patchstack gives the same 4.3 and its own priority of Medium, and says it is expected to be exploited, since flaws like this one have been used in mass exploitation campaigns. That is a prediction by Patchstack, not a report that this CVE is exploited. The record's CISA KEV flag is false.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get essential-blocks --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=essential-blocks --fields=name,version,status
Anything at or below 4.2.0 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update Essential Blocks for Gutenberg to 4.2.1 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Review the registered accounts on the site, since Patchstack lists Subscriber as the role needed, which is the default for new sign ups.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
Broken access control, CWE-862, means the plugin runs an action without first checking that the user is allowed to do it. WordPress gives plugin authors capability checks and nonces for this, and the check has to be added to each action. When one action lacks it, a user with a low role, or no account at all, can call it.
The weakness in the record is CWE-862, missing authorization. The effect depends on what the unprotected action does, and the record only describes it as exploiting incorrectly configured access control security levels. Patchstack lists Subscriber as the privilege needed. That is the lowest role, and many sites let anyone register for it.
The fix is a one line change for the developer, which is why these bugs are common and why the plugin update is usually small. For site owners the hard part is keeping up. A site with twenty plugins has twenty places where this can happen, so track versions and update on a schedule.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-47760 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Why does Patchstack call it likely to be exploited at 4.3?
Patchstack says flaws of this kind have been used in mass campaigns. It is a forecast, not a report of attacks on this CVE.
Sources
Last reviewed: 19 October 2026.
