¿Es seguro Super Progressive Web Apps?

Qué hace este plugin

• Slug: super-progressive-web-apps
• Autor: SuperPWA
• 40000+ instalaciones activas
• 92/100 calificación (225 reseñas en wordpress.org)
• 2392786 descargas totales
• En WordPress.org desde 2018-01-24

add to homescreenAndroid Appchrome appprogressive web appspwa

Estado de mantenimiento

• Última actualización: 2026-06-16 7:17am GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 5.3+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

1 CVE conocido registrado para Super Progressive Web Apps. Reportadas entre 2021 y 2023.

CVE-2023-48277

No patched version is available. Abdi Pranata discovered and reported this Broken Access Control vulnerability in WordPress Super Progressive Web Apps Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has not been known to be fixed yet.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Super Progressive Web Apps [super-progressive-web-apps] < 2.2.9

The Super Progressive Web Apps plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the superpwa_send_feedback function in versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to submit feedback to the plugin developers.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Super Progressive Web Apps [super-progressive-web-apps] < 2.1.13

Authenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE) discovered by WPScan Team in WordPress Super Progressive Web Apps plugin (versions <= 2.1.12).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Super Progressive Web Apps [super-progressive-web-apps] < 2.1.12

When the Apple Touch Icons & Splash Screen add-on is active, its superpwa_splashscreen_uploader AJAX action, does not properly check for CSRF, authorisation and the content of the uploaded archive file. This allows attackers to upload an archive with a PHP file, leading to RCE by either using a low privilege account (subscriber+) or a CSRF attack on any logged in user. v2.1.11 fixed the CSRF check, only. v2.1.12 added capability check.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Super Progressive Web Apps [super-progressive-web-apps] < 2.1.13

When the Apple Touch Icons & Splash Screen add-on is active, its superpwa_splashscreen_uploader AJAX action, did not properly check for authorisation and the content of the uploaded archive file. This allows high privilege users (admin+) to upload an archive with a PHP file, leading to RCE. v2.1.12 attempted to fix the issue by deleting potential malicious files, after extracting the archive, but was checking the wrong folder. And even if the correct folder was checked, a race condition could have been used to exploit the issue

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• WPMobile.App — 3000+ instalaciones activas — 96/100 (161)
• PWA — easy way to Progressive Web App — 2000+ instalaciones activas — 96/100 (26) — PHP máx. 8.4
• AppPresser – Mobile App Framework — 1000+ instalaciones activas — 74/100 (53) — PHP máx. <8.0