CVE-2022-1425 describes an Insecure Direct Object Reference (IDOR) vulnerability in the WPQA Builder Plugin for WordPress, affecting versions prior to 5.2. This flaw allows authenticated users to read private messages of any other user due to insufficient validation of message_id in the wpqa_message_view AJAX action. Rated with a CVSS score of 4.3 (MEDIUM), the vulnerability has a low attack complexity and requires low privileges, but only impacts confidentiality (C:L). There is no indication of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, with no mentions across social media or news articles. The vulnerability is not listed in the CISA KEV catalog and has an EPSS score indicating a very low probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.2CPE matchmatch criteria | cpe:2.3:a:2code:wpqa_builder:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.