CVE-2022-1598

The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.

Score

CVSS 3.1 5.3 Medium

Status

Modified - contact@wpscan.com

Published

2022-06-08

Last modified

2024-08-03

Weaknesses

CWE-306

Affected products

• Wpqa Builder (2code)
• Wpqa Builder (Unknown)

References

• https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8