CVE-2023-47805 is a missing authorization flaw in the WPCafe plugin for WordPress. NVD scores it 5.3, Medium. Versions up to 2.2.22 are affected, and Patchstack lists 2.2.23 as the patched release. Update the plugin as soon as you can. Patchstack lists no account as needed.
What's affected
The record lists WPCafe for WordPress, up to and including 2.2.22. Patchstack's entry gives 2.2.22 as the last vulnerable version and 2.2.23 as the first patched one. It records the required privilege as no account (Unauthenticated).
NVD scores it 5.3, Medium, with a Low confidentiality impact. Patchstack gives the same 5.3 and a Medium priority, and says flaws of this kind have been used in mass exploitation campaigns. That is a forecast and not a report of attacks on this CVE. The record's KEV flag is false.
Source note: the Patchstack page address mentions version 2.2.19, but the page itself lists vulnerable versions up to 2.2.22 and the fix in 2.2.23, which matches the record.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get wp-cafe --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=wp-cafe --fields=name,version,status
Anything at or below 2.2.22 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update WPCafe to 2.2.23 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Because Patchstack lists no account as needed, do not rely on locking down user roles. Restrict the WordPress admin area by IP address where you can.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
Broken access control, CWE-862, means the plugin runs an action without first checking that the user is allowed to do it. WordPress gives plugin authors capability checks and nonces for this, and the check has to be added to each action. When one action lacks it, a user with a low role, or no account at all, can call it.
The weakness in the record is CWE-862, missing authorization. The effect depends on what the unprotected action does, and the record only describes it as exploiting incorrectly configured access control security levels. Patchstack lists no account as needed, which matches the NVD vector (PR:N). Anyone who can reach the site can call the action. The impact is rated Low confidentiality only.
The fix is a one line change for the developer, which is why these bugs are common and why the plugin update is usually small. For site owners the hard part is keeping up. A site with twenty plugins has twenty places where this can happen, so track versions and update on a schedule.
Quick check
Is CVE-2023-47805 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Does the attacker need to log in?
No. Patchstack lists no privilege as needed, and the NVD vector requires none.
Sources
Last reviewed: 19 October 2026.
