CVE-2026-39603

MediumCVSS 5.4

Published: 08/04/2026(UTC)Updated: 20/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

The Grand Photography WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated administrator.

Risk Assessment

A CSRF attack could lead to unauthorized changes in plugin settings, injection of malicious content, or account takeover without the administrator's consent.

Recommendation

Immediately update the Grand Photography plugin to a version newer than 5.7.8 and implement CSRF tokens in all forms.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.