CVE-2022-2198CWE-639

WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR

published August 22, 2022

CVSS
—
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00753 · 54.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-08-22T15:00Z
EPSS history
Timeline
  • 22 AUG 15:00Z
    WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR
    cvelistv5