CVE-2023-47788 is a missing authorization flaw in the Jetpack plugin for WordPress. NVD scores it 4.3, Medium. Versions up to 12.6.3, meaning anything before 12.7 are affected, and Patchstack lists 12.7 as the patched release. Update the plugin as soon as you can.
What's affected
The record lists Jetpack for WordPress, up to and including 12.6.3, meaning anything before 12.7. Patchstack's entry gives 12.6.3, meaning anything before 12.7 as the last vulnerable version and 12.7 as the first patched one. It records the required privilege as Contributor.
The record says the issue affects Jetpack before 12.7, and Patchstack agrees, listing vulnerable versions below 12.7 and 12.7 as the patched release. Patchstack's page is the source for the Contributor requirement. I use the phrase before 12.7 for the range, not a specific earlier number.
NVD scores it 4.3, Medium, with an availability impact of Low. Patchstack gives the same 4.3 and sets a Low priority, noting it is unlikely to be exploited. They agree.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get jetpack --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=jetpack --fields=name,version,status
Anything at or below 12.6.3, meaning anything before 12.7 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update Jetpack to 12.7 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Review the Contributor accounts on the site, since Patchstack lists that role as the one needed.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
Broken access control, CWE-862, means the plugin runs an action without first checking that the user is allowed to do it. WordPress gives plugin authors capability checks and nonces for this, and the check has to be added to each action. When one action lacks it, a user with a low role, or no account at all, can call it.
The weakness in the record is CWE-862, missing authorization. The effect depends on what the unprotected action does, and the record only describes it as exploiting incorrectly configured access control security levels. The NVD vector rates only a Low availability impact, with no confidentiality or integrity impact, so the harm is limited in scope.
The fix is a one line change for the developer, which is why these bugs are common and why the plugin update is usually small. For site owners the hard part is keeping up. A site with twenty plugins has twenty places where this can happen, so track versions and update on a schedule.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-47788 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Is there a version number for the last vulnerable release?
Patchstack and the record say before 12.7, so I use that wording. The first fixed release is 12.7.
Sources
Last reviewed: 19 October 2026.
