CVE-2023-47874 is a medium severity (CVSS 5.4) missing authorization flaw in the Perfmatters plugin for WordPress, affecting versions through 2.1.6. Update to a release newer than 2.1.6. I could not load the Patchstack page, so confirm the exact fixed version in the plugin changelog.
What's affected
The NVD record describes a Missing Authorization vulnerability in Perfmatters that affects versions from n/a through 2.1.6. The weakness class is CWE-862 (Missing Authorization). The record scores it 5.4 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L: network reachable, low complexity, a low privilege account needed, and limited impact on integrity and availability.
The only reference in the record is a Patchstack database entry titled for Perfmatters 2.1.6 broken access control. That page returned a block error to our automated fetch, so we have no confirmed fixed version, no researcher details and no timeline. Anything newer than 2.1.6 is outside the affected range stated in the record, but the vendor changelog should be your source for the release that carries the fix.
The record does not flag the CVE as exploited in the wild.
How to check if you're exposed
Perfmatters is a commercial performance plugin, so updates come from the vendor's own channel as well as the usual plugin screen. List the installed version with WP-CLI.
wp plugin list --name=perfmatters --fields=name,version,status,update
If the version shows 2.1.6 or lower, you are in the affected range. In the admin, open Plugins and read the version number under Perfmatters.
Also review who holds accounts on the site. The vector says a low privilege login is enough, so a site that lets visitors register as subscribers or customers has a larger exposed population than one with staff only accounts.
What to do now
- Update Perfmatters to a version newer than 2.1.6 from your vendor account or the plugin update screen.
- Read the vendor changelog to confirm which release lists the access control fix.
- Review user registration settings and remove stale low privilege accounts.
- Keep a record of the plugin version on each site so you can answer future advisories quickly.
Why it matters
Missing authorization is a classic access control bug. A feature checks that someone is logged in, but never checks that they are allowed to use that specific function. The result is that a low privilege user can trigger actions meant for administrators.
The score is medium because the impact is limited, but these bugs are often chained with others. A performance plugin touches site settings and caching, so unauthorised changes can alter how the whole site behaves. Teams that track plugin versions as part of their dependency inventory can handle this kind of advisory in minutes. Use the Safeguard Gold page for this CVE for the record and the free scan at gold.safeguard.sh/scan for your application dependencies.
Quick check
Which Perfmatters versions are affected by CVE-2023-47874?
The record says versions through 2.1.6. Confirm the first fixed release in the vendor changelog.
Why is the score only medium?
The record vector needs a low privilege login and shows limited impact on integrity and availability, with no impact on confidentiality.
Sources
Last reviewed: 19 October 2026.
