CVE-2023-4728: 
WordPress vulnerability analysis and mitigation

The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 4.4. The vulnerability stems from a missing capability check on the publish_lp() function hooked via an AJAX action. This security flaw was discovered and disclosed on March 12, 2024 (NVD).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, and 4.3 (Medium) according to Wordfence. The vulnerability allows authenticated attackers with subscriber-level access or higher to change the LadiPage key, which is fully controlled by the attacker. The missing capability check in the publish_lp() function enables attackers to freely create new pages, including those containing stored XSS payloads (NVD).

The vulnerability enables authenticated attackers with subscriber-level access to modify data and create new pages without proper authorization. This can lead to stored Cross-Site Scripting attacks, potentially compromising the security of the WordPress installation and affecting site visitors (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L). User interaction is required in some scenarios (UI:R) according to the CVSS metrics (NVD).

Website administrators should update the LadiApp plugin to a version newer than 4.4 if available. If an update is not available, it is recommended to consider disabling the plugin until a security patch is released (NVD).