PT-2024-16713 · WordPress · Apppresser

Khayal Farzaliyev + 1 · Published 2024-11-26 · Updated 2024-11-26 · CVE-2024-11024

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The AppPresser – Mobile App Framework plugin for WordPress versions up to, and including, 4.4.6

Description The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate a user's password reset code before updating their password. As a result, unauthenticated attackers who know a user's email address can reset the user's password and gain access to their account.

Recommendations For versions up to, and including, 4.4.6, update to a version that fixes the password reset validation issue to prevent account takeover. As a temporary workaround, consider restricting access to the password reset functionality until a patch is available.

Fix

Weakness Enumeration

CWE-230

Related Identifiers

CVE-2024-11024

Affected Products

Apppresser

References · 6

• https://osv.dev/vulnerability/CVE-2024-11024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11024 · Security Note
• https://plugins.trac.wordpress.org/changeset/3192531/apppresser · Patch
• https://twitter.com/CveFindCom/status/1861373225218761032 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/43cb0399-4add-43d5-863c-30e11803bd90?source=cve · Note
• https://twitter.com/CVEnew/status/1861371125978063092 · Twitter Post