CVE-2022-1349
PoC —CVSS 3.1
4.3 medium
EPSS
<1%p49
Published
()
Modified
Description
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.
- Vendors
- 2code
- Products
- wpqa builder
- Ecosystems
- WordPress
- Weakness
- CWE-287
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
In the news0 stories
No ingested article mentions this CVE yet.