CVE-2026-39635
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Grand Magazine WordPress plugin contains a CSRF vulnerability that allows an attacker to perform unauthorized actions in the context of a logged-in administrator. The flaw affects all versions up to and including 3.5.5.
Risk Assessment
An attacker can exploit CSRF to change plugin settings, inject malicious content, or perform other operations without the administrator's knowledge, potentially leading to full site compromise.
Recommendation
Immediately update the Grand Magazine plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.