CVE-2023-4730

The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L153
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L187
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4baf2e-7f5e-4954-88f9-76d32f297aab?source=cve

Published

Aug 17, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47283Directory traversal vulnerability in CubeCart prior to 6.5.3…4.9
• CVE-2023-4729The LadiApp plugin for WordPress is vulnerable to Cross-Site…4.3
• CVE-2023-47294An issue in NCR Terminal Handler v1.5.1 allows low-level pri…8.1
• CVE-2023-47295A CSV injection vulnerability in NCR Terminal Handler v1.5.1…9.8
• CVE-2023-47297A settings manipulation vulnerability in NCR Terminal Handle…9.8
• CVE-2023-47298An issue in NCR Terminal Handler 1.5.1 allows a low-level pr…4.3
• CVE-2023-47304An issue was discovered in Vonage Box Telephone Adapter VDV2…7.8
• CVE-2023-47307Buffer Overflow vulnerability in /apply.cgi in Shenzhen Libi…7.5
• CVE-2023-47308In the module "Newsletter Popup PRO with Voucher/Coupon code…9.8
• CVE-2023-47309Nukium nkmgls before version 3.0.2 is vulnerable to Cross Si…5.4
• CVE-2023-4731The LadiApp plugn for WordPress is vulnerable to Cross-Site …4.3
• CVE-2023-47310A misconfiguration in the default settings of MikroTik Route…6.5