WordPress · Ladiapp · CVE-2023-4729
**Name of the Vulnerable Software and Affected Versions**
LadiApp plugin for WordPress versions up to, and including, 4.4
**Description**
The issue is related to a missing nonce check on the `publish lp()` function, which is hooked via an AJAX action. This allows unauthenticated attackers to change the LadiPage key, enabling them to create new pages, including those that trigger stored XSS via a forged request, if they can trick a site administrator into performing a certain action, such as clicking on a link.
**Recommendations**
For versions up to, and including, 4.4, consider disabling the `publish lp()` function until a patch is available to prevent exploitation. Restrict access to the AJAX action hooked by the `publish lp()` function to minimize the risk of exploitation. Avoid using the LadiApp plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.