CVE-2022-1251: Ask Me < 6.8.4 - CSRF in Edit Profile

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-22 · updated 2026-06-17
Weakness: CWE-352

Description

The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request.

Affected products

inkthemes Ask Me: before 6.8.4 — fixed in 6.8.4

How to fix

Upgrade to a fixed version: inkthemes Ask Me 6.8.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349
https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349

Get alerted when CVE-2022-1251 or the next vulnerability affects your stack