CVE-2026-39632

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The Grand Blog plugin by ThemeGoods for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 3.1. An attacker can exploit CSRF to perform unauthorized actions on behalf of an administrator.

Risk Assessment

The organization may be at risk of unauthorized changes to blog configuration if an administrator is tricked into clicking a malicious link.

Recommendation

It is recommended to update the Grand Blog plugin to a version later than 3.1 that contains the CSRF fix.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.