Grand Car Rental CVE-2026-39633

While CVSS 6.5 appears moderate, multiple signals indicate this is a lower-priority issue in practice. EPSS 0.01% (1st percentile) reflects extremely low exploitation probability, suggesting this vulnerability has minimal real-world traction. The CVSS vector confirms authentication is required (PR:L) and user interaction (UI:R) is necessary, both of which significantly constrain exploitation in automated attacks. The attack vector is network-accessible (AV:N) and complexity is low (AC:L), but the combination of required authentication, user interaction, and limited impact (C:L, I:L, A:L) places this squarely in the category of low-urgency vulnerabilities. No active exploitation (KEV) or public POC is reported, further supporting deprioritization relative to unauthenticated or high-impact flaws.

An attacker crafts a malicious webpage containing hidden requests (e.g., image tags or form submissions) that target a Grand Car Rental theme function. When an authenticated site administrator or editor visits the attacker's page in the same browser session, the theme executes unintended actions (such as modifying settings or creating content) on behalf of the user without explicit consent. The attack requires the victim to be logged into the WordPress site and to visit the attacker-controlled page, limiting real-world feasibility compared to unauthenticated vulnerabilities.