AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass

Wordfence Intelligence   >   Vulnerability Database   >   AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass
8.1
Improper Check or Handling of Exceptional Conditions
CVE CVE-2024-4611
CVSS 8.1 (High)
Publicly Published May 28, 2024
Last Updated May 29, 2024
Researcher István Márton - Wordfence

Description

The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCookieAuth' functions in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they previously used the login via the plugin API. This can only be exploited if the 'openssl' php extension is not loaded on the server.

References

Share

Vulnerability Details for AppPresser – Mobile App Framework

AppPresser – Mobile App Framework

Software Type Plugin
Software Slug apppresser (view on wordpress.org)
Patched? Yes
Remediation Update to version 4.4.0, or a newer patched version
Affected Version
  • <= 4.3.2
Patched Version
  • 4.4.0

Recent vulnerabilities in AppPresser – Mobile App Framework

AppPresser – Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure
5.3
CVE-2025-11881
Oct 29, 2025
Researcher: D01EXPLOIT OFFICIAL
AppPresser – Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-1561
Mar 12, 2025
Researcher: wesley (wcraft)
AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset
9.8
CVE-2024-11024
Nov 25, 2024
Researcher: shaman0x01
AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP
8.1
CVE-2024-9305
Oct 15, 2024
Researcher: wesley (wcraft)
AppPresser <= 4.3.0 - Missing Authorization
5.3
CVE-2024-32776
Apr 22, 2024
Researcher: Kévin Mosbahi (Mika)
AppPresser <= 4.3.0 - Cross-Site Request Forgery via force_logging_off()
4.3
CVE-2024-31374
Apr 10, 2024
Researcher: Kévin Mosbahi (Mika)
AppPresser <= 4.3.0 - Cross-Site Request Forgery via toggle_logging_callback()
4.3
CVE-2024-31268
Apr 5, 2024
Researcher: Dhabaleshwar Das
AppPresser <= 4.2.5 - Insecure Password Reset Mechanism
8.1
CVE-2023-4214
Nov 16, 2023
Researcher: István Márton
# Title CVE ID CVSS Researchers Date
1 AppPresser – Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure CVE-2025-11881 5.3 D01EXPLOIT OFFICIAL October 29, 2025
2 AppPresser – Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting CVE-2025-1561 7.2 wesley (wcraft) March 12, 2025
3 AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset CVE-2024-11024 9.8 shaman0x01 November 25, 2024
4 AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP CVE-2024-9305 8.1 wesley (wcraft) October 15, 2024
5 AppPresser <= 4.3.0 - Missing Authorization CVE-2024-32776 5.3 Kévin Mosbahi (Mika) April 22, 2024
6 AppPresser <= 4.3.0 - Cross-Site Request Forgery via force_logging_off() CVE-2024-31374 4.3 Kévin Mosbahi (Mika) April 10, 2024
7 AppPresser <= 4.3.0 - Cross-Site Request Forgery via toggle_logging_callback() CVE-2024-31268 4.3 Dhabaleshwar Das April 5, 2024
8 AppPresser <= 4.2.5 - Insecure Password Reset Mechanism CVE-2023-4214 8.1 István Márton November 16, 2023
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation