Read the docs
TI-2022-02034 Aliases CVE-2022-2198GHSA-g3r5-hp64-fq8f

WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR

Priority LOW 21CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-639.

Summary

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.

Why it matters now

EPSS 0.00753 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WPQA Builder (Unknown): 5.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWPQA Builder5.7 to before 5.75.7Patch availableCNA
  • WPQA Builder VendorUnknown Affected 5.7 to before 5.7 Fixed in 5.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:*before 5.7Vulnerable2code
  • cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:* Versions before 5.7 Vulnerable ·2code

Remediation

  • Fix · CNA WPQA Builder (Unknown) Fixed in 5.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2198
  2. 2026-10-03 Alias added: GHSA-g3r5-hp64-fq8f

References

Exploit 1

  • TI-2024-02207 WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF CVSS 3.1HIGH 8.8
  • TI-2022-03390 WPQA < 5.9 - Follow/Unfollow via CSRF CVSS 3.1HIGH 8.8
  • TI-2024-02206 WPQA < 6.1.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.9
  • TI-2022-03090 WPQA < 5.9.3 - Missing validation lead to functionality abuse CVSS 3.1LOW 3.5
  • TI-2022-01467 WPQA < 5.4 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2022-01468 WPQA < 5.5 - Unauthenticated Private Message Disclosure CVSS 3.1MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences