CVE-2022-2198
WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR
- State
- Published
- Severity
- Not scored
- Published
- Aug 22, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jun 24, 2022
Description
The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.
Scores
The record has no CVSS score.
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
WPQA BuilderUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.