The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCookieAuth' functions in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they previously used the login via the plugin API. This can only be exploited if the 'openssl' php extension is not loaded on the server.
CVSS
No CVSS.
References
Configurations
History
05 Jun 2025, 20:48
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apppresser:apppresser:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
| CWE | CWE-754 | |
| References | () https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_Theme_Switcher.php?rev=2456516#L167 - Product | |
| References | () https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_User.php?rev=2789173#L40 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/d1498fdf-9d5e-4277-92be-469d6646864b?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/changeset/3093975/apppresser - Patch | |
| References | () https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_Theme_Switcher.php?rev=2456516#L133 - Product | |
| First Time |
Apppresser apppresser
Apppresser |
29 May 2024, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-29 05:16
Updated : 2025-06-05 20:48
NVD link : CVE-2024-4611
Mitre link : CVE-2024-4611
JSON object : View
Products Affected
apppresser
- apppresser
CWE
CWE-754
Improper Check for Unusual or Exceptional Conditions