CVE-2023-47232: 
WordPress vulnerability analysis and mitigation

CVE-2023-47232 is a Broken Access Control (CSRF) vulnerability in the WP Affiliate Disclosure WordPress plugin by MojofyWP. It affects all versions up to and including 1.2.6, allowing authenticated users with low privileges (Subscriber level) to perform unauthorized actions due to missing authorization or nonce token checks. The vulnerability was reported on May 6, 2023, by researcher Abdi Pranata and published by Patchstack on November 3, 2023; the CVE was formally published on December 21, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), manifesting as a missing authorization or nonce token check on a privileged function within the plugin. This allows a low-privileged authenticated user (Subscriber role) to invoke actions that should be restricted to higher-privileged roles, constituting a Broken Access Control issue per OWASP Top 10 A5. The attack vector is network-based, requires low privileges, low attack complexity, and no user interaction. Associated attack patterns include Cross-Site Request Forgery (CAPEC-62) and use of unpublished interfaces (CAPEC-36) (Patchstack).

Successful exploitation results in a limited availability impact (Low), with no confidentiality or integrity impact according to the CVSS scoring. An attacker with Subscriber-level access could trigger privileged plugin functions without proper authorization, potentially disrupting plugin functionality or site configuration. While the direct impact is constrained, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

No public exploit code or active in-the-wild exploitation has been specifically reported for CVE-2023-47232. The EPSS score is approximately 0.103%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as a medium-priority issue expected to be exploited in mass-campaign scenarios targeting WordPress plugins broadly (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Affiliate Disclosure plugin version 1.2.6 or earlier using tools like WPScan or Shodan queries targeting WordPress plugin fingerprints.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (many sites allow open registration).
3. Identify unprotected endpoint: Locate the plugin function that lacks proper authorization or nonce validation — this could be an admin AJAX action or a settings-update endpoint exposed by the plugin.
4. Craft malicious request: Send a direct HTTP POST request to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php with the relevant action parameter) without a valid nonce, bypassing the expected access control check.
5. Achieve unauthorized action: The server processes the request as if it were authorized, allowing the attacker to trigger privileged plugin functionality such as modifying plugin settings or resetting values (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php from Subscriber-level user accounts targeting WP Affiliate Disclosure plugin actions, particularly without valid nonce tokens.
• Logs: Unexpected plugin settings changes recorded in WordPress audit logs or database change logs for the wp_options table related to the wp-affiliate-disclosure plugin.
• Network: Repeated automated POST requests to WordPress AJAX endpoints from the same IP address or user agent, consistent with mass-exploit scanning behavior.

The vendor has released version 1.2.7 of the WP Affiliate Disclosure plugin, which patches this vulnerability. Site administrators should update to version 1.2.7 or later immediately via the WordPress plugin dashboard. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated. If immediate updating is not possible, restricting open user registration or disabling the plugin temporarily are interim mitigations (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of October 30 – November 5, 2023, highlighting it as part of broader WordPress plugin security coverage. Patchstack, the discovering organization, classified it as a medium-priority issue warranting immediate mitigation given the prevalence of mass-exploit campaigns targeting WordPress plugins (Wordfence, Patchstack).