CVE-2023-4214

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-620 CWE-640

Affected software

Vendor	Product	Versions
scottopolis	AppPresser – Mobile App Framework	<= 4.2.5
apppresser	apppresser	< 4.3,0

References

Timeline

Published: Nov 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-421435.4Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device CVE-2023-421445.5Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.CVE-2023-421477.5An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component.CVE-2023-42157.5Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user CVE-2023-42162.7The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowin CVE-2023-42175.3A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the CVE-2023-421786.5Lenosp 1.0.0-1.2.0 is vulnerable to SQL Injection via the log query module.CVE-2023-421799.8Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation proc CVE-2023-42185.0In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just n CVE-2023-421808.8An arbitrary file upload vulnerability in the /user/upload component of lenosp 1.0-1.2.0 allows attackers to execute html code via a crafted CVE-2023-421835.3lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restr CVE-2023-421886.5IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF).