CVE-2023-4627 MEDIUM

CVE-2023-4627: LadiApp <= 4.4 - Missing Authorization via save_config()

Vendor Binhnguyenplus
Product LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing…
Weakness CWE-862 · Missing authorization
Published March 12, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() function in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and above to update the 'ladipage_config' option.

Key dates

02Disclosure timeline

March 12, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-7727 HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler CVE-2025-31846 WordPress Theater for WordPress plugin <= 0.18.7 - Broken Access Control vulnerability CVE-2023-4106 A guest user can perform various actions on public playbooks CVE-2025-9054 MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler' CVE-2023-4895 Missing Authorization in GitLab