CVE-2022-1422: 
WordPress vulnerability analysis and mitigation

The Discy WordPress theme before version 5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2022-1422. The vulnerability was discovered on May 16, 2022, and affects the theme's AJAX action 'discy_reset_options' functionality. This security flaw allows potential attackers to reset the site settings to their default values without proper authorization (WPScan).

The vulnerability stems from the theme's failure to implement CSRF token verification in the AJAX action 'discy_reset_options'. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, and a CVSS v2.0 score of 4.3. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

If successfully exploited, an attacker can trick an authenticated administrator into resetting all site settings back to their default values, potentially disrupting the website's configuration and requiring manual reconfiguration of all customized settings (WPScan).

The vulnerability has been fixed in Discy theme version 5.2. Users are advised to update to this version or later to protect against this security issue (WPScan).