The AppPresser – Mobile App Framework plugin for WordPress suffers from a missing capability check in the 'myappp_verify' function in all versions up to and including 4.5.0. This lack of authorization allows unauthenticated users to retrieve sensitive data including plugin and theme identifiers and their versions. Such data exposure can facilitate reconnaissance activities that may lead to more focused attacks on vulnerable or outdated components within the WordPress environment. The vulnerability is tracked as CVE-2025-11881 with a CVSS 3.1 base score of 5.3, reflecting a medium severity level. No patch or official fix has been documented at this time.

The vulnerability allows unauthenticated attackers to obtain sensitive information about the WordPress environment, specifically plugin and theme names and version numbers. While this does not directly compromise confidentiality, integrity, or availability, it can assist attackers in identifying outdated or vulnerable components to target in subsequent attacks. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the affected functionality or monitoring for unusual access patterns related to the 'myappp_verify' function. Avoid exposing sensitive plugin and theme information publicly. Stay updated with vendor announcements for any forthcoming patches.