CVE-2025-11881: AppPresser WordPress Auth Bypass Flaw

CVE-2025-11881 Overview

CVE-2025-11881 affects the AppPresser – Mobile App Framework plugin for WordPress. The vulnerability stems from a missing capability check on the myappp_verify function in all versions up to and including 4.5.0. Unauthenticated attackers can extract sensitive site metadata including installed plugin names, theme names, and version numbers. This reconnaissance data enables targeted follow-on attacks against outdated or vulnerable components on affected WordPress sites. The weakness is classified under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated remote attackers can enumerate installed plugins, themes, and version numbers on WordPress sites running AppPresser 4.5.0 or earlier, enabling targeted exploitation of known component vulnerabilities.

Affected Products

AppPresser – Mobile App Framework plugin for WordPress
All versions up to and including 4.5.0
WordPress sites with AppPresser installed and activated

Discovery Timeline

2025-10-30 - CVE-2025-11881 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11881

Vulnerability Analysis

The AppPresser plugin exposes a REST API endpoint handled by the myappp_verify function within AppPresser_WPAPI_Mods.php. The function lacks any capability or permission check, allowing any unauthenticated HTTP client to invoke the endpoint. When queried, the function returns metadata about the WordPress installation, including enumerated plugin slugs, theme names, and their respective version numbers.

Attackers use this reconnaissance data to identify components with known vulnerabilities. Once outdated or unpatched extensions are identified, adversaries pivot to targeted exploitation using published CVEs against the enumerated versions. This class of information disclosure is a common precursor to WordPress compromise campaigns.

Root Cause

The root cause is a missing authorization check [CWE-862]. The myappp_verify REST route is registered without a permission_callback that validates user capabilities. WordPress REST API best practice requires every route to define a permission callback that returns a capability check or explicit __return_true only when the endpoint is intentionally public and returns no sensitive data.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an HTTP request to the vulnerable REST API endpoint exposed by AppPresser. No authentication, user interaction, or elevated privileges are required. The server responds with a JSON payload containing plugin and theme inventory data, which the attacker parses to build a target profile.

The vulnerability manifests in the REST route registration inside AppPresser_WPAPI_Mods.php at approximately lines 162 and 879. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Snippet for technical details.

Detection Methods for CVE-2025-11881

Indicators of Compromise

Unauthenticated HTTP requests to AppPresser REST endpoints invoking myappp_verify
Requests to /wp-json/ paths registered by the AppPresser plugin from unknown external IP addresses
Bursts of reconnaissance traffic followed by targeted exploit attempts against enumerated plugins or themes
Anomalous user-agent strings consistent with automated WordPress scanners

Detection Strategies

Inventory WordPress installations and flag any running AppPresser 4.5.0 or earlier
Review web server access logs for HTTP requests targeting AppPresser REST routes without an authenticated session
Correlate reconnaissance-style JSON responses with subsequent exploit attempts against specific plugin or theme versions
Deploy WordPress security scanners that flag missing permission callbacks on custom REST endpoints

Monitoring Recommendations

Alert on unauthenticated access to any /wp-json/apppresser/ or related plugin REST namespaces
Track outbound plugin and theme enumeration responses returned to non-administrative clients
Monitor for follow-on exploitation traffic targeting components disclosed via the endpoint
Aggregate WordPress access logs into a centralized SIEM for cross-site correlation

How to Mitigate CVE-2025-11881

Immediate Actions Required

Update the AppPresser – Mobile App Framework plugin to the version released in changeset 3385855 or later
If no patched version is available for your environment, deactivate the AppPresser plugin until it can be updated
Audit web server logs for prior unauthenticated requests to AppPresser REST endpoints and note any reconnaissance activity
Verify that all other installed plugins and themes are on current, supported versions to reduce follow-on exploitation risk

Patch Information

The AppPresser maintainers addressed the missing capability check in WordPress Code Changeset 3385855. The fix adds a permission callback to the affected REST route so the endpoint validates authorization before returning plugin and theme metadata. Site administrators should apply the update through the WordPress plugin dashboard or by installing the corrected package manually.

Workarounds

Restrict access to /wp-json/ REST API paths at the web application firewall or reverse proxy layer for anonymous clients
Block requests to AppPresser-specific REST namespaces from untrusted networks until the patched version is deployed
Use a WordPress security plugin to virtually patch the vulnerable endpoint by enforcing authentication on the myappp_verify route
Disable the AppPresser plugin on sites that do not actively use its mobile app integration features

bash

# Configuration example: block anonymous access to AppPresser REST routes at nginx
location ~* /wp-json/apppresser/ {
    if ($http_authorization = "") {
        return 403;
    }
}