CVE-2022-2198
Last modified
CVE-2022-2198 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.. EPSS estimates a 0.61% chance of exploitation in the next 30 days.
Description
The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| 2code | Wpqa Builder | < 5.7 |
References
- https://wpscan.com/vulnerability/867248f2-d497-4ea8-b3f8-0f2e8aaaa2bdExploit, Third Party Advisory
- https://wpscan.com/vulnerability/867248f2-d497-4ea8-b3f8-0f2e8aaaa2bdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2198?
How severe is CVE-2022-2198?
How do I fix CVE-2022-2198?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-21973Windows Media Center Update Denial of Service Vulnerability5.5
- CVE-2022-21974Roaming Security Rights Management Services Remote Code Exec…7.8
- CVE-2022-21975Windows Hyper-V Denial of Service Vulnerability4.7
- CVE-2022-21977Media Foundation Information Disclosure Vulnerability3.3
- CVE-2022-21978Microsoft Exchange Server Elevation of Privilege Vulnerabili…8.2
- CVE-2022-21979Microsoft Exchange Server Information Disclosure Vulnerabili…4.8
- CVE-2022-21980Microsoft Exchange Server Elevation of Privilege Vulnerabili…8
- CVE-2022-21981Windows Common Log File System Driver Elevation of Privilege…7.8
- CVE-2022-21983Win32 Stream Enumeration Remote Code Execution Vulnerability7.5
- CVE-2022-21984Windows DNS Server Remote Code Execution Vulnerability8.8
- CVE-2022-21985Windows Remote Access Connection Manager Information Disclos…5.5
- CVE-2022-21986.NET Denial of Service Vulnerability7.5
Are you affected by CVE-2022-2198?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST