CVE-2023-4214highCWE-620

CVE-2023-4214: high-severity vulnerability in scottopolis AppPresser – Mobile App Framework

AppPresser <= 4.2.5 - Insecure Password Reset Mechanism

Published · Updated

Follow this CVE+ Monitor AppPresser – Mobile App Framework

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.9%
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
scottopolis · AppPresser – Mobile App Framework
Related CVEs — scottopolis AppPresser – Mobile App Framework

In the same product, most dangerous first.

CVE-2024-11024CRITICALAppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password ResetEPSS 0.7%CVE-2024-9305HIGHAppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTPEPSS 0.7%CVE-2024-4611HIGHAppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication BypassEPSS 0.5%CVE-2025-1561HIGHAppPresser – Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-11881MEDIUMAppPresser – Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information ExposureEPSS 0.3%