CVE-2022-3688 — Cross-Site Request Forgery in Wpqa Builder

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.3%
top 47.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
2code Wpqa Builder
Timeline
PublishedNov 21

Description

The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
WPQA < 5.9 - Follow/Unfollow via CSRF↗2022-11-21
▶
GHSA
GHSA-q58r-qh3r-4w5f: The WPQA Builder WordPress plugin before 5↗2022-11-21
▶
CVE-2022-3688 — Cross-Site Request Forgery | cvebase