The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() function in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to update the 'ladiflow_hook_configs' option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
Configurations
History
15 Jan 2025, 16:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1983 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/0be418fa-f1cf-4aaf-bc94-c8e04186a54b?source=cve - Third Party Advisory | |
| CPE | cpe:2.3:a:ladipage:ladipage:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-352 | |
| First Time |
Ladipage
Ladipage ladipage |
21 Nov 2024, 08:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1983 - | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/0be418fa-f1cf-4aaf-bc94-c8e04186a54b?source=cve - |
12 Mar 2024, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-12 10:15
Updated : 2025-01-15 16:35
NVD link : CVE-2023-4628
Mitre link : CVE-2023-4628
CVE.ORG link : CVE-2023-4628
JSON object : View
Products Affected
ladipage
- ladipage
CWE
CWE-352
Cross-Site Request Forgery (CSRF)