CVE-2023-4728

Summary

CVE-2023-4728 is a vulnerability affecting the LadiApp plugin for WordPress. This issue arises from a missing capability check on the publish_lp() function, which can be exploited via an AJAX action. Authenticated attackers with subscriber-level access or higher can take advantage of this vulnerability to modify data, specifically the LadiPage key. This key control enables the attacker to create new pages, including those with stored Cross-Site Scripting (XSS) vulnerabilities, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.