CVE-2023-4626

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow_save_hook() function in versions up to, and including, 4.3. This makes it possible for authenticated attackers with subscriber-level access and above to update the 'ladiflow_hook_configs' option.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
binhnguyenplus	LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing…	4.3

References

Timeline

Published: Mar 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-462609.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-462619.8An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of CVE-2023-462627.5An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche R CVE-2023-462639.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t CVE-2023-462649.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t CVE-2023-462659.8An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).CVE-2023-462669.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.CVE-2023-46274.3The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() f CVE-2023-462703.3MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.CVE-2023-462719.8Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. This issue arises from the ah_webui serv CVE-2023-462728.8Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute CVE-2023-462738.8Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_s