PT-2024-13343 · WordPress · Ladiapp

Giongfnef · Published 2024-03-12 · Updated 2025-01-21 · CVE-2023-4626

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LadiApp plugin for WordPress versions up to, and including, 4.3

Description The issue is related to a missing capability check on the ladiflow save hook() function, allowing authenticated attackers with subscriber-level access and above to update the ladiflow hook configs option. This enables unauthorized modification of data.

Recommendations For versions up to, and including, 4.3, consider disabling the ladiflow save hook() function until a patch is available to prevent unauthorized data modification. Restrict access to the ladiflow hook configs option to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2023-4626

Affected Products

Ladiapp

References · 7

• https://osv.dev/vulnerability/CVE-2023-4626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4626 · Security Note
• https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1983 · Patch
• https://twitter.com/CVEnew/status/1767488874119352334 · Twitter Post
• https://t.me/cvenotify/108148 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/47dccf26-6c8d-4418-a874-c29749bee537?source=cve · Note
• https://t.me/cvenotify/73544 · Telegram Post