Read the docs
TI-2022-01231 Aliases CVE-2022-1349GHSA-mfhm-pr46-c4c3

WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR

Priority LOW 21CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.

Why it matters now

EPSS 0.00654 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WPQA Builder Plugin (Unknown): 5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWPQA Builder Plugin5.2 to before 5.25.2Patch availableCNA
  • WPQA Builder Plugin VendorUnknown Affected 5.2 to before 5.2 Fixed in 5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:*before 5.2Vulnerable2code
  • cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:* Versions before 5.2 Vulnerable ·2code

Remediation

  • Fix · CNA WPQA Builder Plugin (Unknown) Fixed in 5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WPQA Builder Plugin 5.2

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2022-00948 WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fieldsPriority LOW 27
    • TI-2022-01306 WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDORPriority LOW 21
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1349
  2. 2026-10-03 Alias added: GHSA-mfhm-pr46-c4c3
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2024-02207 WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF CVSS 3.1HIGH 8.8
  • TI-2022-03390 WPQA < 5.9 - Follow/Unfollow via CSRF CVSS 3.1HIGH 8.8
  • TI-2024-02206 WPQA < 6.1.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.9
  • TI-2022-03090 WPQA < 5.9.3 - Missing validation lead to functionality abuse CVSS 3.1LOW 3.5
  • TI-2022-01467 WPQA < 5.4 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2022-01468 WPQA < 5.5 - Unauthenticated Private Message Disclosure CVSS 3.1MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences