The AppPresser – Mobile App Framework plugin for WordPress contains a missing capability check in the 'myappp_verify' function. This flaw lets unauthenticated callers retrieve sensitive data such as plugin and theme names and their respective version numbers. The exposure is limited to informational data that could help an attacker target older or vulnerable components, but it does not provide direct control or code execution.

The vulnerability affects all installations of the AppPresser – Mobile App Framework plugin up to and including version 4.5.0. The plugin is distributed by scottopolis and is commonly used on WordPress sites that rely on its mobile app framework capabilities.

The CVSS score of 5.3 reflects moderate severity. The EPSS score is reported as < 1%, indicating a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the missing authorization by sending unauthenticated HTTP requests to the plugin's REST API endpoint that triggers the 'myappp_verify' routine, thereby obtaining the exposed information. No privileged context or additional credentials are required for exploitation.