CVE-2022-1421
Published: 08 June 2022
Summary
CVE-2022-1421 is a medium-severity CSRF (CWE-352) vulnerability in 2Code Discy. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 7.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Discy WordPress theme prior to version 5.2 contains a cross-site request forgery vulnerability (CWE-352) caused by missing CSRF checks on certain AJAX actions. The flaw is rated CVSS 4.3 and affects any site using the theme that processes administrative settings through unauthenticated or insufficiently protected AJAX endpoints.
An unauthenticated attacker can exploit the issue by crafting a malicious request that a logged-in administrator is tricked into executing, resulting in unauthorized changes to arbitrary theme settings such as payment methods. The attack requires user interaction from the administrator but needs no other privileges on the target site.
Public references published by WPScan document the affected AJAX endpoints and confirm the issue is resolved by updating to Discy 5.2 or later. The associated EPSS score has remained flat at 0.0761 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-24735
Vulnerability details
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.