CVE-2024-11024

The plugin does not properly verify the password reset code before changing it. An attacker, knowing only the victim's email address, can initiate a password reset procedure and set a new password without possessing a valid verification token. As a result, an unauthenticated attacker gains full access to the user account, which classifies the vulnerability as an Auth Bypass leading to privilege escalation (LPE) in case of account takeover with elevated privileges.

An attacker can take over any WordPress user account, including administrator accounts, gaining full control over the website — ability to modify content, install malicious plugins, steal data, and further compromise the infrastructure.

The AppPresser plugin must be updated immediately to a version higher than 4.4.6. A patch is available in the WordPress repository at the address indicated in the references (changeset 3192531). It is also recommended to verify access logs for unauthorized password changes and force all users to re-authenticate.

AppPresser – Mobile App Framework for WordPress in all versions up to and including 4.4.6.