CVE-2026-39635 MEDIUM

CVE-2026-39635: WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Themegoods
Product Grand Magazine
Weakness CWE-352 · CSRF
Published April 8, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.

Explanation of Vulnerability in Simple Terms

02Summary

Grand Magazine versions up to 3.5.5 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of site visitors. An attacker can craft a malicious link or page that, when visited by a logged-in admin or user, triggers unintended changes or deletions. The vulnerability requires user interaction and does not expose sensitive data directly, but can compromise site integrity.

What an attacker can do

03Attacker Capabilities

Trick a logged-in user into performing unwanted actions like changing settings or deleting content.

Potential impact on your site

04Site Impact

Site admins or users could unknowingly modify or delete content, change settings, or perform other actions without their consent.

Conditions required to exploit

05Prerequisites

Victim must visit attacker's malicious link or page while logged into the site.

Key dates

06Disclosure timeline

April 8, 2026 CVE published
April 29, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2016-20074 WordPress Lazy Content Slider Plugin 3.4 CSRF CVE-2026-57758 WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability CVE-2026-8422 Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update CVE-2026-57757 WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-8942 MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page