Access violation vulnerability in LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… 4.4

attacks The LadiApp plugin for WordPress has a security issue that allows unauthorized changes to be made to its data. This is because there is a missing capability check on a function called publish_lp(). This function is connected to an AJAX action and this vulnerability exists in versions up to and including 4.4. This means that attackers who are logged in with subscriber-level access or higher can change the LadiPage key. This key is controlled by the attacker, giving them the ability to create new pages, including ones that can cause harmful cross-site scripting attacks.