Grand Photography CVE-2026-39603

This vulnerability presents a disconnect between its CVSS score and practical risk. The CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) reflects network accessibility and low attack complexity, but the EPSS score of 0.01% (1st percentile) strongly contradicts widespread exploitation likelihood. The UI:R (user interaction required) component is critical - an attacker must trick a site administrator into clicking a malicious link while logged in, a social engineering hurdle. The impact is limited to integrity and availability (I:L/A:L) with no confidentiality breach. No public exploit code, POC, or active exploitation (KEV status absent) has been reported. From an SSVC perspective, this scores as a lower-priority vulnerability: exploitation requires user interaction, the technical impact is limited, and there is no evidence of active weaponization. Organizations should prioritize this below critical/high-CVSS vulnerabilities with higher EPSS scores or confirmed exploitation.

An attacker creates a malicious webpage or sends a phishing email to a site administrator of a WordPress site using Grand Photography theme version 5.7.8 or earlier. The link or page contains an invisible form that, when loaded while the administrator is logged in, submits a request to perform an unintended action such as modifying theme settings, deleting content, or creating a new administrative account. Because the request is issued from the authenticated user's browser session and the theme lacks CSRF token validation, the action succeeds without the administrator's knowledge. No public exploit code has been identified at the time of analysis, but the attack requires only basic HTML/JavaScript knowledge to construct.