CVE-2026-39634

MediumCVSS 5.4

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

CSRF vulnerability in Grand Portfolio (grandportfolio) theme up to version 3.3 inclusive. Allows Cross-Site Request Forgery.

Risk Assessment

An attacker can use CSRF to perform unauthorized actions in the context of an administrator, such as modifying portfolio items.

Recommendation

Update the Grand Portfolio theme to a version above 3.3 where the vulnerability is fixed.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.