CVE-2023-4730: Binhnguyenplus Ladiapp

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts.

Affected products

• Binhnguyenplus Ladiapp: up to and including 4.3
• Binhnguyenplus Ladiapp: Landing Page, Popupx, Marketing Automation, Affiliate Marketing…: up to and including 4.3

Published 2024-08-17. Last modified 2026-06-17.