Unauthorized Password Reset Vulnerability in AppPresser's Mobile App Framework

CVE-2024-9305

Summary

The AppPresser – Mobile App Framework plugin for WordPress has a vulnerability that allows for privilege escalation through account takeover. This issue affects all versions up to and including 4.4.4. The root cause lies in the insufficient controls of the appp_reset_password() and validate_reset_password() functions. These functions can be exploited by unauthenticated attackers to generate and brute force a one-time password (OTP) for maliciously altering user passwords, including those of administrators. This serious security flaw highlights the importance of implementing robust mechanisms to verify the authenticity of password reset requests.

References