Cross-Site Request Forgery Vulnerability in ThemeGoods Grand Tour
CVE-2026-66652

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Grand Tour
Vendor
CVE Published:
2 September 2026

What is CVE-2026-66652?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the ThemeGoods Grand Tour theme. This flaw could enable attackers to create malicious requests that can execute actions on behalf of unsuspecting users. This vulnerability affects versions from n/a through 5.5.1 of the Grand Tour theme. It is crucial for website administrators using this theme to apply necessary patches or mitigations to safeguard user data and prevent unauthorized actions.

Affected Version(s)

Grand Tour <= 5.5.1

References

https://patchstack.com/database/wordpress/theme/grandtour...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
.