CVE-2022-1598 WPQA < 5.5 - Unauthenticated Private Message Disclosure
Unauthenticated attackers can access private user messages via an unprotected REST API endpoint in the WPQA Builder plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1598?
CVE-2022-1598 is a medium-severity missing authorization vulnerability in Unknown WPQA Builder, published on 6 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.
Weakness: CWE-306
Which versions are affected by CVE-2022-1598?
It affects 1 product.
Products include 2code Wpqa Builder.
How do I fix CVE-2022-1598?
No fix has been published for CVE-2022-1598 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-1598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1598 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Unknown WPQA Builder
- CVE-2024-2376 WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF
- CVE-2022-3688 WPQA < 5.9 - Follow/Unfollow via CSRF
- CVE-2022-1597 WPQA < 5.4 - Reflected Cross-Site Scripting
- CVE-2024-2375 WPQA < 6.1.1 - Contributor+ Stored XSS
- CVE-2022-1051 WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields
Sources
Also known as GHSA-v9x9-r7q4-rfx4.