CVE-2023-47668

MEDIUM

StellarWP Membership Plugin - Restrict Content <= 3.2.7 - Exposure of Sensitive Information via Log File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2023-47668. PoCs published by Boshe99, Nxploited, RandomRobbieBF.

AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2023-47668, targeting an arbitrary file upload vulnerability in the WordPress Plugin 3DPrint Lite 1.9.1.4. The exploit uploads a malicious file via the plugin's admin-ajax.php endpoint and confirms successful upload.

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

Exploits (3)

github WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2023-47668

The repository contains a functional Python exploit for CVE-2023-47668, targeting an arbitrary file upload vulnerability in the WordPress Plugin 3DPrint Lite 1.9.1.4. The exploit uploads a malicious file via the plugin's admin-ajax.php endpoint and confirms successful upload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin 3DPrint Lite 1.9.1.4
No auth needed
Prerequisites: Target URL · Malicious file to upload
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec SCANNER
by Nxploited · poc
https://github.com/Nxploited/CVE-2023-47668

This repository contains a Python script that checks for the presence of a legacy log file (rcp-debug.log) in WordPress sites using the Restrict Content plugin <= 3.2.7, which exposes sensitive information. It does not exploit the vulnerability but scans for its presence.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: StellarWP Membership Plugin – Restrict Content <= 3.2.7
No auth needed
Prerequisites: Target must be running WordPress with the Restrict Content plugin <= 3.2.7
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by RandomRobbieBF · poc
https://github.com/RandomRobbieBF/CVE-2023-47668

The repository provides a functional proof-of-concept for CVE-2023-47668, an information exposure vulnerability in the Restrict Content WordPress plugin. The PoC demonstrates that unauthenticated attackers can access sensitive debug information via a legacy log file at `/wp-content/uploads/rcp-debug.log`.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Membership Plugin – Restrict Content <= 3.2.7
No auth needed
Prerequisites: WordPress site with Restrict Content plugin <= 3.2.7 installed · Legacy log file must exist at `/wp-content/uploads/rcp-debug.log`
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 5.3
EPSS 0.0101
EPSS Percentile 58.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
liquidweb/restrict_content < 3.2.7
StellarWP/Membership Plugin – Restrict Content < 3.2.7
Published Nov 23, 2023
Tracked Since Feb 18, 2026