CVE-2024-4611 HIGH

CVE-2024-4611: AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass

Vendor Scottopolis
Product AppPresser – Mobile App Framework
Weakness CWE-703
Published May 29, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCookieAuth' functions in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they previously used the login via the plugin API. This can only be exploited if the 'openssl' php extension is not loaded on the server.

Key dates

02Disclosure timeline

May 29, 2024 CVE published
April 8, 2026 Record updated