CVE-2026-121853 · Package
NO FIX YET · SEE WHAT TO DO
The AppPresser WordPress plugin before 5.0.0 exposes two REST API endpoints without access checks. An unauthenticated visitor can read the versions of AppPresser, its add-ons and some third-party plugins.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any WordPress site running the AppPresser plugin before 5.0.0 is exposed, since its REST endpoints answer anonymous requests. The exposure is information disclosure of installed versions, which helps an attacker pick known exploits for those plugins. Sites without AppPresser installed can skip it.
Not affected if plugin-not-installed, version-5-or-later
Who cares appresser, self-hosted, wordpress
wp plugin get appresserwp plugin list | grep -i appresser5.0.0 or laterThe AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser WordPress plugin before 5.0.0 and its .
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.