CVE-2022-1421
MEDIUMDiscy < 5.2 - Cross-Site Request Forgery via AJAX Actions
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2022-1421. PoCs published by nb1b3k.
AI-analyzed exploit summary This PoC demonstrates a CSRF vulnerability in Discy WordPress theme versions prior to 5.2, allowing an attacker to update arbitrary plugin settings via a crafted HTML form. The exploit leverages the lack of CSRF checks in the `discy_update_options` AJAX action.
Description
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
Exploits (1)
This PoC demonstrates a CSRF vulnerability in Discy WordPress theme versions prior to 5.2, allowing an attacker to update arbitrary plugin settings via a crafted HTML form. The exploit leverages the lack of CSRF checks in the `discy_update_options` AJAX action.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N