CVE-2024-11024: AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset
First published: Tue Nov 26 2024(Updated: )
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain access to their account.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| AppPresser | <=4.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-11024?
CVE-2024-11024 is considered a high severity vulnerability due to its potential for privilege escalation through account takeover.
How do I fix CVE-2024-11024?
To fix CVE-2024-11024, update the AppPresser – Mobile App Framework plugin to the latest version beyond 4.4.6.
Which versions of AppPresser are affected by CVE-2024-11024?
All versions of the AppPresser – Mobile App Framework plugin up to and including 4.4.6 are affected by CVE-2024-11024.
What type of vulnerability is CVE-2024-11024?
CVE-2024-11024 is a vulnerability related to privilege escalation due to improper validation of password reset codes.
What are the consequences of CVE-2024-11024?
The consequences of CVE-2024-11024 include unauthorized access and control over user accounts, leading to possible data breaches.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apppresser
- canonical/apppresser