Vulnerability · Published Jun 6, 2022 · Assigned by WPScan
CVE-2022-1598WPQA < 5.5 - Unauthenticated Private Message Disclosure
Medium 5.3
In plain English
A medium-severity security flaw in WPQA Builder from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)5.4%top 7.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WPQA Builder | 0 – before 5.5 |
References
- https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 exploit, vdb-entry, technical-description