Skip to content
Sign in
Not rated

CVE-2022-1421 The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in…

Description

The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack

Affected products and versions

Product Affected versions Fixed in
Discy 5.2 earliest → < 5.2 5.2

Other CVEs of Discy

The 4 CVEs of Discy →
CVE-2022-3343 The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress… 3.5 Low CVE-2022-1323 The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the… Not rated CVE-2022-1422 The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing… Not rated
Track this CVE