PT-2024-31911 · WordPress · Apppresser

István Márton · Published 2024-05-29 · Updated 2024-05-29 · CVE-2024-4611

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AppPresser plugin for WordPress versions up to, and including, 4.3.2

Description The issue arises from improper missing encryption exception handling on the decrypt value and doCookieAuth functions. This allows unauthenticated attackers to log in as any existing user, including administrators, if they previously used the login via the plugin API. The exploitation of this issue is conditional on the 'openssl' php extension not being loaded on the server.

Recommendations For versions up to, and including, 4.3.2, update to a version that includes a fix for the improper missing encryption exception handling in the decrypt value and doCookieAuth functions. As a temporary workaround, consider disabling the decrypt value and doCookieAuth functions until a patch is available. Ensure the 'openssl' php extension is loaded on the server to prevent exploitation.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-703

Related Identifiers

CVE-2024-4611

Affected Products

Apppresser

References · 8

• https://osv.dev/vulnerability/CVE-2024-4611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4611 · Security Note
• https://plugins.trac.wordpress.org/changeset/3093975/apppresser · Patch
• https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_Theme_Switcher.php?rev=2456516#L167 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d1498fdf-9d5e-4277-92be-469d6646864b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_Theme_Switcher.php?rev=2456516#L133 · Note
• https://t.me/cvenotify/81330 · Telegram Post
• https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_User.php?rev=2789173#L40 · Note