Grand Car Rental CVE-2025-69151

Exploitation requires a WordPress site running the ThemeGoods Grand Car Rental theme at version 3.7 or earlier with the vulnerable front-end endpoint reachable without authentication (PR:N), and a victim must click an attacker-supplied link or visit an attacker-controlled page (UI:R from the CVSS vector). Meaningful privileged impact additionally requires the victim to be an authenticated WordPress user - typically an administrator - at the time of execution, since unauthenticated visitors clicking the link suffer only client-side compromise of their own session with the rental site. Exploitation is limited by the user-interaction requirement (no drive-by mass exploitation), by browser XSS mitigations such as CSP or XSS-auditor heuristics where configured, and by the relatively narrow installed base of a single commercial theme.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L produces a 7.1 (High) score driven primarily by network reachability, no privileges required, and a scope change - but exploitation requires user interaction (UI:R), which materially lowers drive-by risk to a phishing-style click. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be asserted; treat real-world risk as moderate rather than urgent. There is no public exploit identified at time of analysis, and the only intelligence source is the Patchstack advisory, so detection coverage and exploit maturity are likely limited. The most realistic high-impact outcome is administrator session hijack or backdoor injection via a malicious link, which is a credible threat for any WordPress site with an active admin user but not a worm-like mass-exploitation scenario.

An attacker crafts a URL pointing at a vulnerable Grand Car Rental endpoint with a malicious script payload in a reflected parameter and sends it to a site administrator via phishing email, social media, or a comment. When the admin clicks the link while authenticated to wp-admin, the script executes in their browser context and can exfiltrate session cookies, create a new administrator account via the REST API, or inject a persistent backdoor into theme/plugin files - no public exploit identified at time of analysis but the technique is well-understood for WordPress XSS.