CVE-2023-47873 is a critical (CVSS 9.1) unrestricted file upload flaw in the WP Child Theme Generator plugin for WordPress. The record says it affects versions through 1.0.9, while Patchstack says through 1.1.2. Both agree it needs administrator access. Update to 1.1.3 or later, or remove the plugin.
What's affected
This one has a source conflict, so here are both views. The NVD record says WP Child Theme Generator by WEN Solutions is affected "from n/a through 1.0.9". The Patchstack entry, published on 20 November 2023, says versions up to and including 1.1.2 are vulnerable, and that 1.1.3 is the patched release. The slug of the Patchstack page mentions 1.0.8, which adds to the confusion. Because the ranges differ, the safe reading is that anything below 1.1.3 should be treated as affected.
Severity is also worth a second look. The record scores it 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The PR:H part means the attacker needs a high privilege account. Patchstack agrees on the 9.1 score, lists the required privilege as Administrator, and rates its own priority as Low with the note that exploitation is unlikely. A critical score and a low practical priority can both be true at once.
The weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type). The record does not flag the CVE as exploited in the wild.
How to check if you're exposed
With WP-CLI, read the installed version.
wp plugin list --name=wp-child-theme-generator --fields=name,version,status
In the admin screen, open Plugins and read the version beside WP Child Theme Generator. If the version is below 1.1.3, treat the site as affected.
Because the attack needs an administrator account, also check who has that role. List administrators with wp user list --role=administrator and confirm that every entry belongs to a real person. Look in the uploads and theme folders for files you do not recognise, particularly script files that have no business being there.
What to do now
- Update the plugin to 1.1.3 or later, which Patchstack lists as the patched version.
- If you do not need a child theme generator on a live site, deactivate and delete it. It is a build time tool, not something a production site needs running.
- Audit administrator accounts, enforce strong passwords and enable two factor sign in for them.
- Scan the uploads and theme directories for unexpected executable files.
- Check the advisory again for the exact affected range, since the sources disagree.
Why it matters
Unrestricted file upload happens when a feature accepts a file and fails to check its type or destination strongly enough. On a PHP host, a script file that lands in a web accessible folder can run. That is why this class so often scores near the top of the scale, even when the feature sits behind a login.
The administrator requirement lowers the odds a lot, but it does not remove the risk. Admin credentials leak through reused passwords and phishing, and a second flaw can hand them to an attacker. A tool that generates files on disk is also a poor fit for a live production site, so removal is a sound answer. Read the Safeguard Gold page for this CVE for the record details.
Quick check
Is CVE-2023-47873 exploitable without logging in?
Both the record vector (PR:H) and Patchstack say the attacker needs administrator level access.
Which version is safe?
Patchstack lists 1.1.3 as the patched release. The NVD record gives a different upper bound of 1.0.9, so use 1.1.3 or later.
Sources
Last reviewed: 19 October 2026.
