CVE-2023-47826 is a missing authorization flaw in the Restaurant and Cafe Addon for Elementor plugin for WordPress. NVD scores it 6.5, Medium. Versions up to 1.5.3 are affected, and Patchstack lists 1.5.4 as the patched release. Update the plugin as soon as you can.
What's affected
The record lists Restaurant and Cafe Addon for Elementor for WordPress, up to and including 1.5.3. Patchstack's entry gives 1.5.3 as the last vulnerable version and 1.5.4 as the first patched one. It records the required privilege as no account (Unauthenticated).
NVD scores it 6.5, Medium, with Low integrity and availability impact. Patchstack gives the same 6.5 and a Medium priority, and says flaws of this kind have been used in mass exploitation campaigns. That is a forecast and not a report of attacks on this CVE. The record's KEV flag is false.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get restaurant-cafe-addon-for-elementor --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=restaurant-cafe-addon-for-elementor --fields=name,version,status
Anything at or below 1.5.3 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update Restaurant and Cafe Addon for Elementor to 1.5.4 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Because no account is needed, restrict the WordPress admin area by IP address where you can, and keep the plugin updated.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
Broken access control, CWE-862, means the plugin runs an action without first checking that the user is allowed to do it. WordPress gives plugin authors capability checks and nonces for this, and the check has to be added to each action. When one action lacks it, a user with a low role, or no account at all, can call it.
The weakness in the record is CWE-862, missing authorization. The effect depends on what the unprotected action does, and the record only describes it as exploiting incorrectly configured access control security levels. Patchstack lists no account as needed, which matches the NVD vector (PR:N). That is the reason the score is higher than for the Subscriber level issues in the same series.
The fix is a one line change for the developer, which is why these bugs are common and why the plugin update is usually small. For site owners the hard part is keeping up. A site with twenty plugins has twenty places where this can happen, so track versions and update on a schedule.
Quick check
Is CVE-2023-47826 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Is this the same flaw as the other plugins in this series?
The class is the same, missing authorization, but each plugin has its own flaw and its own fixed version.
Sources
Last reviewed: 19 October 2026.
