CVE-2023-4214 AppPresser <= 4.2.5 - Insecure Password Reset Mechanism
Attackers can take over accounts via insecure password reset codes in the AppPresser WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4214?
CVE-2023-4214 is a high-severity authentication bypass vulnerability in scottopolis AppPresser – Mobile App Framework, published on 18 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
Which versions are affected by CVE-2023-4214?
It affects 1 product.
Products include Apppresser Apppresser.
How do I fix CVE-2023-4214?
No fix has been published for CVE-2023-4214 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-4214 being exploited?
There is no known exploitation of CVE-2023-4214 in the wild and no public exploit code.
Other vulnerabilities in scottopolis AppPresser – Mobile App Framework
- CVE-2024-11024 AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset
- CVE-2024-9305 AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP
- CVE-2024-4611 AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass
- CVE-2025-1561 AppPresser – Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-32776 WordPress AppPresser plugin <= 4.3.0 - Broken Access Control vulnerability
Sources
Also known as GHSA-4jjc-6xj9-r5q6.