CVE-2022-1323: Discy < 5.0 - Subscriber+ Broken Access Control to change settings

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-08 · updated 2026-06-17
Weakness: CWE-862

Description

The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.

Affected products

Discy: before 5.0 — fixed in 5.0

How to fix

Upgrade to a fixed version: Discy 5.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/2d8020e1-6489-4555-9956-2dc190aaa61b
https://wpscan.com/vulnerability/2d8020e1-6489-4555-9956-2dc190aaa61b

Get alerted when CVE-2022-1323 or the next vulnerability affects your stack