PT-2023-13313 · WordPress · Wpqa Builder

H4R5H_T4Nd37 + 1 · Published 2023-01-09 · Updated 2023-03-17 · CVE-2022-3343

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPQA Builder WordPress plugin versions prior to 5.9.3

Description The issue arises from incorrect validation in the wpqa following you ajax action, allowing a user to inflate their score by receiving repeated follow actions from another user. This can be exploited by having another user send multiple follow requests.

Recommendations For WPQA Builder WordPress plugin versions prior to 5.9.3, update to version 5.9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the wpqa following you ajax action to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2022-3343

Affected Products

Wpqa Builder

References · 5

• 🔥 https://wpscan.com/vulnerability/e507b1b5-1a56-4b2f-b7e7-e22f6da1e32a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3343 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3343 · Vendor Advisory
• https://t.me/cibsecurity/56201 · Telegram Post
• https://t.me/cvenotify/41646 · Telegram Post