Himer
CVE-2024-2231
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (wpscan) · only source for this CVE.
CVSS VectorVendor: wpscan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
The allows any authenticated user to join a private group due to a missing authorization check on a function
AnalysisAI
The allows any authenticated user to join a private group due to a missing authorization check on a function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. The allows any authenticated user to join a private group due to a missing authorization check on a function Affected products include: 2Code Himer.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.
The lacks CSRF checks allowing a user to invite any user to any group (including private groups). Rated high severity (C
The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high pr
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make use
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make log
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make use
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today