CVE-2025-11881: 
WordPress vulnerability analysis and mitigation

The AppPresser – Mobile App Framework plugin for WordPress contains a vulnerability (CVE-2025-11881) related to unauthorized access of data. The vulnerability affects all versions up to and including 4.5.0, and was discovered on October 29, 2025. The issue stems from a missing capability check on the 'myappp_verify' function, which allows unauthenticated attackers to access sensitive information (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is categorized as CWE-862 (Missing Authorization) and specifically involves the absence of proper authorization checks in the 'myappp_verify' function, which is exposed through the WordPress REST API (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to extract sensitive data including plugin and theme names and version numbers. This information disclosure can be leveraged to facilitate targeted attacks against outdated or vulnerable components (NVD).

A fix has been released in version 4.5.1 of the AppPresser plugin, which implements proper authorization checks for the affected endpoint. Users are advised to update to this version immediately (WordPress Plugin).