LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpoint
Vulnerability Description
The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-4730
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- GiongfNef
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4baf2e-7f5e-4954-88f9-76d32f297aab?source=cve
- https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L153
- https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175
- https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L187
More from binhnguyenplus
View All →Affected Vendor
binhnguyenplus
View all reports →