CVE-2022-1421: 2code Discy

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack

Affected products

• 2code Discy: before 5.2 (fixed in 5.2)

Published 2022-06-08. Last modified 2026-06-17.