CVE-2022-1422: Discy < 5.2 - Restore Default Settings via CSRF

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-08 · updated 2026-06-17
Weakness: CWE-352

Description

The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults.

Affected products

Discy: before 5.2 — fixed in 5.2

How to fix

Upgrade to a fixed version: Discy 5.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/29aff4bf-1691-4dc1-a670-1f2c9a765a3b
https://wpscan.com/vulnerability/29aff4bf-1691-4dc1-a670-1f2c9a765a3b

Get alerted when CVE-2022-1422 or the next vulnerability affects your stack