{"id":"CVE-2026-121853","kind":"vulnerability","aliases":["CVE-2026-121853"],"related":[],"title":"AppPresser WordPress plugin: REST endpoints leak installed plugin versions","description":"The AppPresser  WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser  WordPress plugin before 5.0.0 and its .","summary":"The AppPresser WordPress plugin before 5.0.0 exposes two REST API endpoints without access checks. An unauthenticated visitor can read the versions of AppPresser, its add-ons and some third-party plugins.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appresser","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-5-or-later"],"how_to_check":"- Check the installed AppPresser version in the WordPress admin plugin list, or with `wp plugin get appresser`\n- Check whether the plugin is installed at all: `wp plugin list | grep -i appresser`","fix":"- AppPresser: move to `5.0.0` or later","status":"open","published_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:35+00:00","updated_at":"2026-11-13T06:42:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T06:42:35Z","model":"claude-haiku-5-5","output":{"fix":"- AppPresser: move to `5.0.0` or later","reach":"internet","title":"AppPresser WordPress plugin: REST endpoints leak installed plugin versions","impact":"low","summary":"The AppPresser WordPress plugin before 5.0.0 exposes two REST API endpoints without access checks. An unauthenticated visitor can read the versions of AppPresser, its add-ons and some third-party plugins.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","appresser","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker learns installed plugin versions, enabling targeted exploits","analyst_note":"","how_to_check":"- Check the installed AppPresser version in the WordPress admin plugin list, or with `wp plugin get appresser`\n- Check whether the plugin is installed at all: `wp plugin list | grep -i appresser`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-5-or-later"],"who_is_affected":"Any WordPress site running the AppPresser plugin before 5.0.0 is exposed, since its REST endpoints answer anonymous requests. The exposure is information disclosure of installed versions, which helps an attacker pick known exploits for those plugins. Sites without AppPresser installed can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000715,"input_tokens":4554,"output_tokens":520,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121853':12A,15A '-2026':11A,14A '5.0.0':27B,60C,94C 'access':34B,64C 'add':47B,84C 'add-on':46B,83C 'allow':72C 'api':31B,70C 'apppress':1A,23B,44B,56C,81C,90C 'appress':16B 'check':35B 'cve':10A,13A 'endpoint':5A,32B,71C 'expos':28B 'host':20B 'instal':7A,78C 'leak':6A 'on':48B,85C 'packag':17B 'parti':53B,89C 'plugin':3A,8A,25B,54B,58C,92C 'read':40B 'rest':4A,30B,69C 'restrict':63C 'retriev':76C 'self':19B 'self-host':18B 'sever':86C 'third':52B,88C 'third-parti':51B,87C 'two':29B,66C 'unauthent':37B,73C 'version':9A,42B,79C 'visitor':38B,74C 'without':33B 'wordpress':2A,21B,24B,57C,91C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the AppPresser plugin before 5.0.0 is exposed, since its REST endpoints answer anonymous requests. The exposure is information disclosure of installed versions, which helps an attacker pick known exploits for those plugins. Sites without AppPresser installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["appresser","low","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-121853':12A,15A '-2026':11A,14A 'apppress':1A 'cve':10A,13A 'endpoint':5A 'instal':7A 'leak':6A 'plugin':3A,8A 'rest':4A 'version':9A 'wordpress':2A","search_b":"'5.0.0':27B 'access':34B 'add':47B 'add-on':46B 'api':31B 'apppress':23B,44B 'appress':16B 'check':35B 'endpoint':32B 'expos':28B 'host':20B 'on':48B 'packag':17B 'parti':53B 'plugin':25B,54B 'read':40B 'rest':30B 'self':19B 'self-host':18B 'third':52B 'third-parti':51B 'two':29B 'unauthent':37B 'version':42B 'visitor':38B 'without':33B 'wordpress':21B,24B","search_c":"'5.0.0':60C,94C 'access':64C 'add':84C 'add-on':83C 'allow':72C 'api':70C 'apppress':56C,81C,90C 'endpoint':71C 'instal':78C 'on':85C 'parti':89C 'plugin':58C,92C 'rest':69C 'restrict':63C 'retriev':76C 'sever':86C 'third':88C 'third-parti':87C 'two':66C 'unauthent':73C 'version':79C 'visitor':74C 'wordpress':57C,91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121853","severity":null,"published_at":"2026-11-13T06:16:53+00:00","modified_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}