WordPress Plugin Vulnerabilities

WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR

Description

The plugin which is a companion plugin to the Hilmer and Discy themes, does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.

Proof of Concept

Affects Plugins

Plugin icon
wpqa
Fixed in 5.7

References

CVE
CVE-2022-2198

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bikram kharal
Submitter
Bikram kharal
Submitter website
https://bikramkharal.com.np/
Submitter twitter
themarkib
Verified
Yes
WPVDB ID
867248f2-d497-4ea8-b3f8-0f2e8aaaa2bd

Timeline

Publicly Published
2022-08-01 (about 3 years ago)
Added
2022-08-01 (about 3 years ago)
Last Updated
2023-04-30 (about 2 years ago)

Other

Published
Title
Published
2024-11-20
Title
If-So Dynamic Content Personalization < 1.9.2.2 - Authenticated (Contributor+) Post Disclosure
Published
2025-07-31
Title
Service Finder Bookings < 6.1 - Authentication Bypass via User Switch Cookie
Published
2025-03-07
Title
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel < 2.4.30 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates
Published
2023-01-17
Title
WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
Published
2024-09-24
Title
REST API TO MiniProgram < 4.7.6 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover