Grand Portfolio CVE-2026-39634

While the CVSS score of 5.4 suggests medium severity, multiple signals indicate low real-world risk. The EPSS score of 0.01% (bottom percentile) shows exploitation is exceptionally rare in observed data. The attack requires user interaction (UI:R) and network access (AV:N), meaning a victim must visit a malicious site while logged into their WordPress admin panel. The impact scope is unchanged (S:U), limiting effects to the vulnerable application only. Integrity and availability impacts are low (I:L, A:L)-not confidentiality compromise. For WordPress theme CSRF vulnerabilities targeting low-privilege content changes, this represents a lower practical risk than the CVSS suggests, particularly if the theme is not widely deployed or if administrators follow security hygiene practices. However, any unauthenticated CSRF remains a valid security concern in defense-in-depth strategies.

An attacker creates a malicious website or sends a crafted HTML email containing an embedded request (e.g., an img tag or form submission) targeting the Grand Portfolio theme's admin settings endpoint. When an authenticated WordPress administrator visits the attacker's site while logged into their own WordPress dashboard, the browser automatically includes the admin's session cookies with the malicious request. Because the theme lacks CSRF token validation, the request succeeds, allowing the attacker to modify theme settings, inject malicious code into theme options, or alter published content without the admin's explicit consent. The attack is silent and requires no additional user interaction beyond visiting the malicious page.