CVE-2021-24800
DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
- Record
CVE-2021-24800- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
CVE List No score
DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
- Record
CVE-2021-24800- Weakness
- CWE-639
- Updated
- 2026-11-02
EUVDEUVD-2021-11712 No score
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
- Record
EUVD-2021-11712- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q6xh-rw6q-pcc2
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to...
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
- Record
GHSA-q6xh-rw6q-pcc2- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24800 is a medium vulnerability (CVSS 4.3) in Designwall Dw Question \& Answer, published April 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. No source names a fixed version.