The AppPresser – Mobile App Framework plugin for WordPress contains a vulnerability in its password reset functionality (appp_reset_password() and validate_reset_password() functions). These functions lack sufficient controls to prevent brute force attacks on the OTP used for password resets and do not verify that the reset request originates from an authorized user. As a result, an unauthenticated attacker can generate and brute force OTPs to reset passwords of any user, including administrators, leading to privilege escalation via account takeover. The vulnerability is tracked as CVE-2024-9305 with a CVSS 3.1 score of 8.1 (high severity).

Successful exploitation allows an unauthenticated attacker to reset passwords of any user, including administrators, resulting in full account takeover and privilege escalation. This compromises confidentiality, integrity, and availability of the affected WordPress site using the AppPresser plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password reset functionality if possible and monitor for suspicious password reset attempts. Avoid using vulnerable versions of the plugin and consider disabling the plugin temporarily if password reset functionality cannot be secured.