CVE-2024-2040: Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-03 · updated 2026-06-17
Weakness: CWE-352

Description

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack

Affected products

Himer: before 2.1.1 — fixed in 2.1.1

How to fix

Upgrade to a fixed version: Himer 2.1.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/1b97bbf0-c7d1-4e6c-bb80-f9bf45fbfe1e/
https://wpscan.com/vulnerability/1b97bbf0-c7d1-4e6c-bb80-f9bf45fbfe1e/

Get alerted when CVE-2024-2040 or the next vulnerability affects your stack