Forced private-group joining via missing AJAX nonce

Cross-site request forgery in 2code Himer before 2.1.1 allows remote attackers to force an administrator to join private groups via forged requests. The wpqa_join_group AJAX action performs the state-changing operation without correct WordPress nonce validation, so it accepts a request originating outside the site. Exploitation requires an administrator with an active session to interact with attacker-controlled content; the demonstrated consequence is unauthorized group membership.