Cross-Site Request Forgery in ThemeGoods Grand Photography
CVE-2026-39603

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Grand Photography
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39603?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the ThemeGoods Grand Photography theme, which allows unauthorized commands to be transmitted from a user that the web application trusts. This issue affects all versions of Grand Photography up to and including 5.7.8, enabling attackers to perform actions on behalf of authenticated users without their consent. It is crucial for users of this theme to implement security measures to mitigate potential exploits.

Affected Version(s)

Grand Photography 0 <= 5.7.8

References

https://patchstack.com/database/Wordpress/Theme/grandphot...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
.