CVE-2023-4214 HIGH

CVE-2023-4214: AppPresser <= 4.2.5 - Insecure Password Reset Mechanism

Vendor Scottopolis
Product AppPresser – Mobile App Framework
Weakness CWE-620 · Unverified password change
Published November 18, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.

Key dates

02Disclosure timeline

November 18, 2023 CVE published
April 8, 2026 Record updated