CVE-2023-4214
18.11.2023, 02:15
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apppresser | apppresser | 𝑥 < 4.3.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| apppresser | apppresser | 𝑥 < 4.3,0 | ADP |
Common Weakness Enumeration
- CWE-620 - Unverified Password ChangeWhen setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
- CWE-640 - Weak Password Recovery Mechanism for Forgotten PasswordThe software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.