CVE-2022-1323
Discy < 5.0 - Subscriber+ Broken Access Control to change settings
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
08 Aug 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.
Affected products
Unknown · Discy