The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults.CreditsBikram KharalReferenceshttps://wpscan.com/vulnerability/29aff4bf-1691-4dc1-a670-1f2c9a765a3b
