CVE-2022-1323: 
WordPress vulnerability analysis and mitigation

The Discy WordPress theme before version 5.0 contains a vulnerability identified as CVE-2022-1323. The vulnerability was discovered and publicly disclosed on July 12, 2022. This security issue affects the theme's authorization system, specifically impacting installations of the Discy WordPress theme versions prior to 5.0 (WPScan).

The vulnerability stems from missing authorization checks when processing ajax requests to the discy_update_options action. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD).

When exploited, this vulnerability allows any authenticated user, including those with privileges as low as Subscriber level, to modify theme options by sending crafted POST requests. This could lead to unauthorized changes to the theme's configuration and potentially affect the website's appearance and functionality (WPScan).

The vulnerability can be exploited by sending a crafted POST request to /wp-admin/admin-ajax.php with the action parameter set to discy_update_options. The attack requires only basic authentication (subscriber level access) to execute (WPScan).

The vulnerability has been fixed in Discy theme version 5.0. Users are advised to update their Discy WordPress theme to version 5.0 or later to mitigate this security issue (WPScan).