Grand Tour Theme CVE-2026-66652

Exploitation requires that a logged-in WordPress user with sufficient privileges (administrator or equivalent) visits an attacker-controlled page while their authenticated session is active. The Grand Tour theme must be installed and active on the target WordPress site running a version at or below 5.5.1. No special server configuration or non-default settings are required beyond the theme being present and active. Exploitation is limited by the mandatory user-interaction step: the attack cannot be automated without first successfully social-engineering or phishing a privileged site user.

The CVSS 5.4 Medium rating is consistent with CSRF's typical impact profile: integrity and availability are both rated Low, confidentiality is unaffected. The PR:N metric reflects that the attacker needs no account on the target site, while UI:R correctly captures the prerequisite that a logged-in site user (likely an administrator or editor) must visit an attacker-controlled page or click a malicious link. EPSS data is not provided, and neither CISA KEV status nor public proof-of-concept code is indicated, which together lower the near-term exploitation probability. Practically, even a mid-sized municipal tourism operator or travel agency using this theme - similar in scale to a gniezno-based tour company - should treat this as a straightforward patching task rather than an emergency, since exploitation requires a targeted social-engineering step against an authenticated admin. The overall risk is moderate for sites where administrators are routinely targeted by phishing, and lower for sites without active threat-actor interest.

An attacker crafts a malicious web page containing a hidden HTML form that submits a forged request to the victim's WordPress site - for example, altering tour listing content or theme settings. When an authenticated site administrator visits the attacker's page (via a phishing link or malicious ad), the browser automatically sends the forged request with the administrator's session cookie, causing the server to execute the unauthorized action. No public exploit code is confirmed, but the technique is trivially reproducible from standard CSRF documentation.