Potential Privilege Escalation Vulnerability in AppPresser Mobile App Framework Plugin for WordPress

CVE-2024-11024

What is CVE-2024-11024?

The AppPresser Mobile App Framework plugin for WordPress has a vulnerability that enables privilege escalation through account takeover. In versions up to and including 4.4.6, the plugin fails to correctly validate a user's password reset code before allowing a password update. This oversight permits unauthorized attackers, who possess a user's email address, to reset the user's password and potentially gain access to their account. This vulnerability underscores the need for robust security measures to properly validate user actions and safeguard personal information.

References