CVE-2023-47868 is a high severity (CVSS 7.3) privilege escalation flaw in the wpForo Forum plugin for WordPress, in versions up to and including 2.2.3. Patchstack lists 2.2.4 as the patched release. Update the plugin to 2.2.4 or later and review your administrator accounts.
What's affected
The NVD record describes an Improper Privilege Management issue in wpForo Forum that allows privilege escalation, affecting versions from n/a through 2.2.3. The weakness is CWE-269 (Improper Privilege Management). The record scores it 7.3 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means it can be reached over the network with no account and no user action.
The Patchstack entry, published on 20 November 2023, agrees on the affected range (2.2.3 and earlier) and names 2.2.4 as the patched version. It also gives the same 7.3 score. Patchstack's page lists the required privilege as unauthenticated and describes the outcome as a low privilege user becoming an administrator. Note that the vector in the record shows partial impact on each of confidentiality, integrity and availability, while Patchstack's plain language summary describes full site control. Treat the worst case as real when you plan.
The record does not flag this CVE as exploited in the wild, and I did not find a statement to that effect in the Patchstack page. Patchstack does describe this class of issue as one that is used in mass exploitation campaigns in general, which is a statement about the class, not a report about this CVE.
How to check if you're exposed
If you have shell access and WP-CLI, list the plugin version directly.
wp plugin list --name=wpforo --fields=name,version,status,update
Anything below 2.2.4 is in the affected range. In the WordPress admin, open Plugins, find wpForo Forum and read the version number under its name. Check every site you host, including staging copies and old multisite installs that nobody visits.
Also look at users. Open the Users screen and sort by role. Any administrator you do not recognise, or any account whose role changed recently, deserves a closer look before you decide the site is clean.
What to do now
- Update wpForo Forum to 2.2.4 or later from the WordPress plugin screen, or with
wp plugin update wpforo. - Review every account with the administrator role and remove ones you did not create.
- Reset passwords for administrators if you see unexplained changes, and rotate any API keys stored in the site.
- Turn on auto-updates for the plugin if your change process allows it.
- Add the plugin to your software inventory so the next advisory is matched automatically.
Why it matters
Improper privilege management means the code lets someone act with more rights than their account should hold. In a forum plugin that is serious, because forums accept registrations from the public by design. The path from a visitor to an administrator is short when role checks are missing or wrong.
For a WordPress site owner the practical lesson is that plugins are dependencies with their own release cycle. A site can run on a patched core and still be exposed through one add-on. Tracking plugin versions the same way you track libraries in an application is the only way to answer "are we exposed?" in minutes. See the Safeguard Gold page for this CVE for the record, or paste your own dependency manifests into the free in-browser scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which wpForo version fixes CVE-2023-47868?
Patchstack lists 2.2.4 as the patched version. The affected range is 2.2.3 and earlier.
What should I check after updating?
Review the list of administrator accounts and remove any you did not create, since privilege escalation would show up as an unexpected admin.
Sources
Last reviewed: 19 October 2026.
