CVE-2022-3343 WPQA < 5.9.3 - Missing validation lead to functionality abuse
Attackers can inflate user scores by exploiting missing validation in the WPQA Builder plugin's follow functionality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3343?
CVE-2022-3343 is a low-severity vulnerability in Unknown Discy, published on 9 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate that a user already follows another in the wpqa_following_you_ajax action, allowing a user to inflate their score on the site by having another user send repeated follow actions to them.
Which versions are affected by CVE-2022-3343?
It affects 1 product.
Products include 2code Wpqa Builder.
How do I fix CVE-2022-3343?
No fix has been published for CVE-2022-3343 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3343 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3343 exists.
Other vulnerabilities in Unknown Discy
- CVE-2024-2376 WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF
- CVE-2022-3688 WPQA < 5.9 - Follow/Unfollow via CSRF
- CVE-2022-1597 WPQA < 5.4 - Reflected Cross-Site Scripting
- CVE-2024-2375 WPQA < 6.1.1 - Contributor+ Stored XSS
- CVE-2022-1051 WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields
Sources
Also known as GHSA-v24x-rp9v-pm6r.