Security readout for executives and security teams
Plain-English summary
CVE-2023-47180 affects the Finale Lite WordPress plugin for WooCommerce through version 2.16.0. The issue is missing authorization that can allow arbitrary content deletion. Business impact is potential site content loss or disruption on exposed WordPress commerce sites, but the provided sources do not show confirmed active exploitation.
Executive priority
Treat as a moderate priority for WordPress commerce sites using Finale Lite. Prioritize inventory and remediation for revenue-facing storefronts because unauthenticated content deletion can disrupt campaigns or site availability, even though confirmed exploitation is not shown.
Technical view
The vulnerability is CWE-862 missing authorization in XLPlugins Finale Lite, package finale-woocommerce-sales-countdown-timer-discount, affecting versions through 2.16.0. CVSS 3.1 is 6.5: network reachable, low complexity, no privileges or user interaction, with low integrity and availability impact and no confidentiality impact.
Likely exposure
Exposure is likely limited to WordPress/WooCommerce sites with Finale Lite installed at version 2.16.0 or earlier. The bundle does not identify affected CPEs, hosting environments, or a confirmed fixed version.
Exploitation context
The CVSS vector indicates unauthenticated remote reachability, but the source bundle does not provide exploit details. KEV is false, and no cited source in the bundle establishes active exploitation in the wild.
Researcher notes
Evidence is concise and does not include endpoint details, proof of concept, patch metadata, or exploit telemetry. Avoid assuming broader WooCommerce exposure. Focus validation on plugin presence, version, advisory status, and signs of unexpected content deletion.
Mitigation direction
- Inventory WordPress/WooCommerce sites for the Finale Lite plugin and version.
- Check XLPlugins, WordPress plugin, and Patchstack guidance for a fixed release or workaround.
- Update the plugin if vendor guidance identifies a corrected version.
- Disable or remove the plugin where business use is not required.
- Ensure recent backups exist before plugin changes or recovery work.
Validation and detection
- Confirm whether finale-woocommerce-sales-countdown-timer-discount is installed on each site.
- Record plugin versions and flag any installation at 2.16.0 or earlier.
- Review content audit trails and backups for unexpected deletions.
- Verify remediation status against vendor or Patchstack guidance.
- Regression test WooCommerce promotional workflows after update, disablement, or removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-47180 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L3.92.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/plugin/finale-woocommerce-sales-countdown-timer-discount/vulnerability/wordpress-finale-lite-sales-countdown-timer-discount-for-woocommerce-plugin-2-16-0-arbitrary-content-deletion-vulnerability?_s_id=cveCVE reference · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.