title: WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR
description: The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.
problem types: CWE-639 Authorization Bypass Through User-Controlled Key
affected:
{
product: WPQA Builder Plugin
vendor: Unknown
versions:
lessThan: 5.2, status: affected, version: 5.2, versionType: custom
}