CVE-2024-11024 is a critical vulnerability in the AppPresser – Mobile App Framework WordPress plugin (up to version 4.4.6) caused by improper validation of password reset codes. This weakness allows unauthenticated attackers who know a user's email address to reset that user's password without authorization, resulting in account takeover and privilege escalation. The issue stems from the plugin's failure to properly handle missing or invalid reset codes, categorized as CWE-230. The vulnerability has a CVSS v3.1 base score of 9.8, reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to reset any user's password by bypassing the password reset code validation. This leads to full account takeover, compromising user confidentiality, integrity, and availability. The attacker gains unauthorized access to user accounts, potentially leading to further privilege escalation and control over the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of the AppPresser plugin should monitor the vendor's communications closely. Until a fix is available, consider disabling the password reset functionality or restricting access to it as a temporary mitigation. Avoid exposing user email addresses publicly to reduce the risk of targeted attacks.