CVE-2022-1349CWE-287

WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR

published May 16, 2022

CVSS
—
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00654 · 50.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-05-16T14:30Z
EPSS history
Timeline
  • 16 MAY 14:30Z
    WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR
    cvelistv5