CVE-2026-39634

CVE-2026-39634 is a Cross-Site Request Forgery (CSRF) vulnerability affecting ThemeGoods Grand Portfolio through version 3.3. This vulnerability allows unauthenticated attackers to execute unauthorized actions on behalf of legitimate users without their knowledge or consent. The flaw impacts the Grand Portfolio plugin's web application security posture by failing to implement adequate CSRF protections. The vulnerability carries a CVSS severity rating of 5.4 (Medium) with a network attack vector requiring only user interaction, making it relatively easy to exploit from a remote location. While the impact is limited to integrity and availability concerns with no confidentiality breach, the combination of low complexity and no privilege requirements presents a meaningful security risk for affected installations. Currently, this vulnerability shows no indication of active exploitation in the wild, with an EPSS score of 0.00016 indicating minimal real-world exploitation probability. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists, suggesting limited community attention and no readily available public exploit code at this time.