---
id: "CVE-2026-121853"
page: "https://infrastack.ai/live/CVE-2026-121853"
kind: "vulnerability"
aliases: ["CVE-2026-121853"]
title: "AppPresser WordPress plugin: REST endpoints leak installed plugin versions"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["appresser", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-5-or-later"]
published_at: "2026-11-13T06:16:53+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:42:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121853", "first_seen_at": "2026-11-13T06:42:16+00:00"}]
exploit_sources: []
---

# AppPresser WordPress plugin: REST endpoints leak installed plugin versions

Link for people: https://infrastack.ai/live/CVE-2026-121853 (this .md is for agents)

The AppPresser WordPress plugin before 5.0.0 exposes two REST API endpoints without access checks. An unauthenticated visitor can read the versions of AppPresser, its add-ons and some third-party plugins.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AppPresser version in the WordPress admin plugin list, or with `wp plugin get appresser`
- Check whether the plugin is installed at all: `wp plugin list | grep -i appresser`

## Fix

- AppPresser: move to `5.0.0` or later

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121853

## From the sources

The AppPresser  WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser  WordPress plugin before 5.0.0 and its .

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_