CVE-2023-4731

The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to modify a variety of settings, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts,

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L153Product
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175Patch, Product
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L187Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1a46fd57-4cb9-4d98-89b6-926d74b2ab33?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L153Product
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175Patch, Product
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L187Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1a46fd57-4cb9-4d98-89b6-926d74b2ab33?source=cveThird Party Advisory

Published

Mar 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47298An issue in NCR Terminal Handler 1.5.1 allows a low-level pr…4.3
• CVE-2023-4730The LadiApp plugn for WordPress is vulnerable to unauthorize…5.3
• CVE-2023-47304An issue was discovered in Vonage Box Telephone Adapter VDV2…7.8
• CVE-2023-47307Buffer Overflow vulnerability in /apply.cgi in Shenzhen Libi…7.5
• CVE-2023-47308In the module "Newsletter Popup PRO with Voucher/Coupon code…9.8
• CVE-2023-47309Nukium nkmgls before version 3.0.2 is vulnerable to Cross Si…5.4
• CVE-2023-47310A misconfiguration in the default settings of MikroTik Route…6.5
• CVE-2023-47311An issue in Yamcs 5.8.6 allows attackers to send aribitrary …6.1
• CVE-2023-47312Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Acc…6.5
• CVE-2023-47313Headwind MDM Web panel 5.22.1 is vulnerable to Directory Tra…5.4
• CVE-2023-47314Headwind MDM Web panel 5.22.1 is vulnerable to cross-site sc…5.4
• CVE-2023-47315Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Acc…8.8