CVE-2023-4214
AppPresser <= 4.2.5 - Insecure Password Reset Mechanism
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
| CWE | CWE-620 |
| Vendor | scottopolis |
| Product | apppresser – mobile app framework |
| Published | Nov 18, 2023 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for scottopolis apppresser – mobile app framework
Be the first to know when new high vulnerabilities affecting scottopolis apppresser – mobile app framework are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
scottopolis / AppPresser – Mobile App Framework
0 ≤ 4.2.5
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/4c44c36a-c4c7-49c2-b750-1589e7840dde?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_WPAPI_Mods.php#L567 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/2997160/apppresser plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_API_Limit.php?rev=2997182
Credits
István Márton