CVE-2026-121853: AppPresser < 5.0.0 - Unauthenticated Plugin and Theme Version Disclosure
The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser WordPress plugin before 5.0.0 and its .
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AppPresser WordPress pluginto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Who can access the disclosed version information?
Any unauthenticated visitor can access the affected REST API endpoints; no login or other authentication is required.
What information can be exposed through the affected endpoints?
The endpoints can reveal installed version information for AppPresser, its add-ons, and several third-party AppPresser-related plugins and themes.
Are installations running version 5.0.0 affected?
The issue affects AppPresser versions before 5.0.0. The provided information does not indicate that version 5.0.0 or later is affected.