CVEvulnerability

CVE-2022-2198

4.3 MEDIUM Published 2022-08-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-08-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639

Description

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.

Affected configurations

• 2code wpqa builder (< 5.7)

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References