CVE-2022-1349
Medium
Description
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.
SeverityMedium
CVSS4.3
Exploit probability—
Product2code Wpqa Builder
PublishedMay 16, 2022
First seenMay 16, 2022
Weakness typeCWE-287Improper authentication
How to fix
Update
- 2code wpqa_builder5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 2code wpqa_builder | v < 5.2 | 5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.