CVE-2022-2198

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-219808.0Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2022-219817.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2022-219837.5Win32 Stream Enumeration Remote Code Execution VulnerabilityCVE-2022-219848.8Windows DNS Server Remote Code Execution VulnerabilityCVE-2022-219855.5Windows Remote Access Connection Manager Information Disclosure VulnerabilityCVE-2022-219867.5.NET Denial of Service VulnerabilityCVE-2022-219878.0Microsoft SharePoint Server Spoofing VulnerabilityCVE-2022-219887.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-219897.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-21996.1The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain controCVE-2022-219908.8Remote Desktop Client Remote Code Execution VulnerabilityCVE-2022-219918.1Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
CVE-2022-2198: Medium severity, CVSS 4.3 | Vulnix