CVE-2022-1323

The CVE-2022-1323 entry concerns the Discy WordPress theme prior to version 5.0, where a lack of authorization checks in the handling of the discy_update_options AJAX action allows any logged-in user (privilege as low as Subscriber) to modify theme options via a crafted POST to admin-ajax.php. Th...

CVE-2022-1422

CVE-2022-1422 concerns the WordPress theme Discy (versions before 5.2). The exposed issue is a CSRF in the AJAX endpoint discy_reset_options , which attackers can abuse to trick an admin into restoring site settings to defaults. Connected sources (Red Hat, CNVD, CVE lists, PatchStack/WP vuln DB) ...

CVE-2022-1421

CVE-2022-1421 pertains to the Discy WordPress theme (versions prior to 5.2). The vulnerability is a cross-site request forgery (CSRF) flaw in certain AJAX actions that allows an authenticated attacker (with admin privileges) to modify settings, including payment methods. Impact is limited to admi...