CVE-2022-1598: WPQA < 5.5 - Unauthenticated Private Message Disclosure

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-08 · updated 2026-06-17
Weakness: CWE-306

Description

The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.

Affected products

WPQA Builder: before 5.4 — fixed in 5.4

How to fix

Upgrade to a fixed version: WPQA Builder 5.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8
https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8

Get alerted when CVE-2022-1598 or the next vulnerability affects your stack