CVE-2024-4611
The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_value' and on the 'doCookieAuth' functions in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they previously used the login via the plugin API. This can only be exploited if the 'openssl' php extension is not loaded on the server.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.50%
- CWE
- CWE-703
- Published
- 2024-05-29
- Last modified
- 2026-04-09
Affected products
- scottopolis AppPresser – Mobile App Framework
- scottopolis AppPresser – Mobile App Framework
Weakness type
Related vulnerabilities
- CVE-2026-80135 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-57445 — Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve
- CVE-2026-20280 — Cisco IOS XR Software Security Hardening Release: September 2026
- CVE-2026-82417 — qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
- CVE-2026-18638 — Velociraptor server crash via the SetPassword API
- CVE-2026-56818 — Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
- CVE-2026-16218 — hunvreus devpush Storage Reset Failure storage.py reset_storage improper check or handling of exceptional conditions
- CVE-2026-20187 — Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling Vulnerabilities