CVE-2023-4629: 
WordPress vulnerability analysis and mitigation

The LadiApp plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2023-4629. The vulnerability affects versions up to and including 4.3 of the plugin, due to a missing nonce check in the save_config() function. This security issue was discovered and reported by researcher GiongfNef (NVD, Patchstack).

The vulnerability stems from a missing nonce check in the save_config() function, which allows for Cross-Site Request Forgery attacks. The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 4.3 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

The vulnerability enables unauthenticated attackers to update the 'ladipage_config' option through forged requests, provided they can trick a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

The vulnerability requires user interaction, specifically requiring an administrator to be tricked into performing certain actions. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N) (NVD).