Vulnerability · Published Mar 12, 2024 · Assigned by Wordfence

CVE-2023-4731LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Cross-Site Request Forgery via init_endpoint

Medium 4.3

In plain English

A medium-severity cross-site request forgery in LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… from binhnguyenplus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to modify a variety of settings, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts,

Affected products (as reported)

Vendor	Product	Versions
binhnguyenplus	LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing…	0 – through 4.4

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References