CVE-2025-11881
MEDIUM
5.3
CVSS 3.1
Description
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'myappp_verify' function in all versions up to, and including, 4.5.0. This makes it possible for unauthenticated attackers to extract sensitive data including plugin and theme names and version numbers, which can be used to facilitate targeted attacks against outdated or vulnerable components.
Affected WordPress components
-
AppPresser – Mobile App Framework Plugin · apppresserUp to and including 4.5.0View on WordPress.org
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- scottopolis AppPresser – Mobile App Framework — Up to and including 4.5.0
References
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/apppresser/tags/4.5.0/inc/AppPresser_WPAPI_Mods.php#L162
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/apppresser/tags/4.5.0/inc/AppPresser_WPAPI_Mods.php#L879
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3385855/
- www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/62c3f54c-6bfb-4f11-9457-a09d28f83175?source=cve
- nvd.nist.gov Official NVD record