CVE-2023-4629

Summary

CVE-2023-4629 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the LadiApp plugin for WordPress. The issue lies in the save_config() function, which lacks a nonce check in versions up to 4.3. This weakness enables unauthenticated attackers to manipulate the 'ladipage_config' option through a malicious request, provided they can persuade a site administrator to execute a specific action such as clicking on a link. Successful exploitation could result in unauthorized configuration changes to the affected WordPress site.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.