CVE-2024-2232: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-2232) affects the Himer - Social Questions and Answers WordPress theme versions below 2.1.3. The vulnerability was discovered and publicly published on July 15, 2024, by security researcher Sushmita Poudel (WPScan).

The vulnerability is a Cross-Site Request Forgery (CSRF) issue where the theme lacks proper CSRF checks in its user invitation functionality. The vulnerability has been assigned a CVSS score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. It is classified under CWE-352 (Cross-Site Request Forgery) and falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

The vulnerability allows an authenticated user to invite any user to any group, including private groups, without proper authorization checks. This could lead to unauthorized access to private groups and potential information disclosure (WPScan).

A proof of concept exists where a logged-in user can exploit this vulnerability by opening an HTML file and replacing group and user IDs to invite any user to any group, including private groups (WPScan).

The vulnerability has been fixed in version 2.1.3 of the Himer - Social Questions and Answers theme. Users are advised to update to this version or later to mitigate the vulnerability (WPScan).