The AppPresser – Mobile App Framework WordPress plugin suffers from CWE-703 due to improper or missing exception handling related to encryption in its 'decrypt_value' and 'doCookieAuth' functions. This vulnerability allows unauthenticated attackers to bypass authentication and impersonate any existing user on the site, including administrators, but only if the PHP 'openssl' extension is not enabled on the server. The vulnerability affects all versions up to and including 4.3.2. No official patch or fix has been published yet, and no known exploits are reported in the wild.

Successful exploitation results in full compromise of user accounts, including administrative accounts, leading to complete loss of confidentiality, integrity, and availability of the affected WordPress site. This can enable attackers to take over the site, modify content, and potentially deploy further malicious actions. The attack requires no privileges or user interaction but depends on the absence of the 'openssl' PHP extension on the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, ensure that the PHP 'openssl' extension is enabled on the server hosting the AppPresser plugin, as its presence prevents exploitation of this vulnerability. Monitor for vendor updates and apply patches promptly once available.