CVE-2022-1424

MEDIUM

Ask me WordPress theme < 6.8.2 - Cross-Site Request Forgery via AJAX Actions

Title source: llm
STIX 2.1

Description

The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/147b4097-dec8-4542-b122-7b237db81c05

Scores

CVSS v3 6.5
EPSS 0.0051
EPSS Percentile 39.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-352
Status published
Products (1)
2code/ask_me < 6.8.2
Published Jun 08, 2022
Tracked Since Feb 18, 2026