vulnerability
WordPress Plugin: wpqa: CVE-2022-3343: Authorization Bypass Through User-Controlled Key
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:L/Au:S/C:N/I:P/A:N) | Dec 13, 2022 | May 15, 2025 | May 15, 2025 |
Severity
4
CVSS
(AV:N/AC:L/Au:S/C:N/I:P/A:N)
Published
Dec 13, 2022
Added
May 15, 2025
Modified
May 15, 2025
Description
The WPQA - Builder forms Addon For WordPress plugin is vulnerable to insecure direct object reference in versions up to, and including, 5.9.2 along with the Himer (less than or equal to 1.9.3) and Discy (less than or equal to 5.5.3) WordPress themes. This is due to insufficient validation of user follows on the wpqa_following_you_ajax action. This makes it possible for authenticated attackers with subscriber-level capabilities and above to inflate follower counts of others by sending repeat follow requests.
Solution
wpqa-plugin-cve-2022-3343
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.