CVE-2023-47846 is a arbitrary file upload flaw in the WP Githuber MD plugin for WordPress. NVD scores it 9.1, Critical. Versions up to 1.16.2 are affected, and Patchstack lists 1.16.3 as the patched release. Update the plugin as soon as you can.
What's affected
The record lists WP Githuber MD for WordPress, up to and including 1.16.2. Patchstack's entry gives 1.16.2 as the last vulnerable version and 1.16.3 as the first patched one. It records the required privilege as Author.
Source conflict on privilege and priority: NVD scores this 9.1, Critical, with a High privilege requirement (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Patchstack gives the same 9.1, and lists the required privilege as Author, with its own priority as Medium. An Author is a lower role than administrator, so the real bar is lower than the High in the vector suggests on many sites.
How to check if you're exposed
Check the installed version in the WordPress admin under Plugins, or from the command line if you use WP-CLI:
wp plugin get wp-githuber-md --field=version
If the plugin is active on several sites, list them all at once:
wp plugin list --name=wp-githuber-md --fields=name,version,status
Anything at or below 1.16.2 needs the update. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Update WP Githuber MD to 1.16.3 or later from the Plugins screen, or run the update through WP-CLI after taking a backup.
- Confirm the new version took effect with the same check as above, on every site and staging copy that carries the plugin.
- Review the accounts with the Author role, since Patchstack lists it as the privilege needed. Check the uploads folder for files that are not images or documents.
- Review the user accounts on the site, and remove accounts you do not recognise or no longer need.
- Add the plugin to your dependency inventory, or run the free in-browser dependency scan, so the next advisory for it reaches you faster.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. Patchstack describes an arbitrary file upload, where attackers can upload malicious files to the server, which can be used to take it over.
On a WordPress server, a file upload that accepts script files is a direct route to running code. That is the reason for the Critical score and the Changed scope. The Author role is common on blogs with several writers, so count how many people on your site hold it.
The fix in 1.16.3 is the only mitigation named. Patchstack offers its own virtual patch to subscribers, but that is a commercial product and not a replacement for the update. Update, then look at what is in your uploads folder.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-47846 exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and the Patchstack page I read does not report exploitation. Treat that as the state of the public record on the day of review, not as a promise.
Is Author a high privilege?
It is lower than administrator and common on multi-author sites. NVD's vector says High, and Patchstack says Author. Count your Author accounts.
Sources
Last reviewed: 19 October 2026.
