Ask Me < 6.8.2 - Multiple CSRF in AJAX Actions
Priority LOW 30CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site.
Why it matters now
EPSS 0.00542 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Ask me (Unknown): 6.8.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Ask me | 6.8.2 to before 6.8.2 | 6.8.2 | Patch available | CNA |
- Ask me VendorUnknown Affected 6.8.2 to before 6.8.2 Fixed in 6.8.2 Patch available CNA
Remediation
- Fix · CNA Ask me (Unknown) Fixed in 6.8.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ask me 6.8.2
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-01128 Ask Me < 6.8.2 - Reflected Cross-Site ScriptingPriority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1424
- 2026-10-03 Alias added: GHSA-gw4p-2m2w-qw96
References
More 2code Ask Me vulnerabilities
- TI-2022-01128 Ask Me < 6.8.2 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-1424 · CVE Program
- CVE-2022-1424 · NVD
- FIRST EPSS
- GHSA-gw4p-2m2w-qw96 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences