CVE-2026-39603
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Grand Photography WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated administrator.
Risk Assessment
A CSRF attack could lead to unauthorized changes in plugin settings, injection of malicious content, or account takeover without the administrator's consent.
Recommendation
Immediately update the Grand Photography plugin to a version newer than 5.7.8 and implement CSRF tokens in all forms.
Other vulnerabilities in Grand Photography
See all- CVE-2026-57769High
The Grand Photography plugin version 5.7.8 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
- CVE-2026-57770Critical
The Grand Photography WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 5.7.8.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.