CVE-2022-1421

The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack

Score

CVSS 3.1 4.3 Medium

Status

Modified - contact@wpscan.com

Published

2022-06-08

Last modified

2024-08-03

Weaknesses

CWE-352

Affected products

• Discy (2code)
• Discy (Unknown)

References

• https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249