CVE-2023-4729

Summary

CVE-2023-4729 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the LadiApp plugin for WordPress. The issue resides in the publish_lp() function, which lacks a necessary nonce check when called via an AJAX action. Unauthenticated attackers can exploit this flaw to modify the LadiPage key, giving them the ability to create new pages on vulnerable sites. This includes malicious pages containing stored XSS payloads, which can be triggered if a site administrator is coerced into executing a specific action, such as clicking on a crafted link. The vulnerability exists in versions up to and including 4.4 of the LadiApp plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.