CVE-2026-39633
Cross-Site Request Forgery in Grand Car Rental
Publication date: 2026-04-08
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themegoods | grand_car_rental | to 3.6.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the Cross Site Request Forgery (CSRF) vulnerability in the Grand Car Rental theme on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the WordPress Grand Car Rental Theme versions up to and including 3.6.9. Detection involves identifying if this specific theme and version is installed on your WordPress site.
You can detect the presence and version of the Grand Car Rental theme by checking the theme files or using WordPress CLI commands.
- Use WP-CLI to list installed themes and their versions: wp theme list
- Check the style.css file in the theme directory (wp-content/themes/grandcarrental/) for the version number.
Since this is a Cross-Site Request Forgery (CSRF) vulnerability, network detection is difficult because it requires user interaction and exploits authenticated sessions. There are no specific network commands or signatures provided to detect exploitation attempts.
Immediate mitigation is to update the theme if an update becomes available or consult hosting providers or developers for assistance.
Can you explain this vulnerability to me?
CVE-2026-39633 is a Cross Site Request Forgery (CSRF) vulnerability found in the WordPress Grand Car Rental Theme versions up to and including 3.6.9.
This vulnerability allows attackers to trick privileged users into performing unwanted actions while they are authenticated. This can happen if the user clicks on malicious links, visits crafted web pages, or submits forms controlled by the attacker.
The vulnerability falls under the OWASP Top 10 category A1: Broken Access Control and has a moderate severity with a CVSS score of 6.5.
Although the attacker does not need to be authenticated, successful exploitation requires interaction from a privileged user.
Currently, no official patch is available, and the issue is considered low priority with low impact, making exploitation unlikely.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to perform unauthorized actions on your WordPress site if a privileged user is tricked into interacting with malicious content.
Such unauthorized actions could include changes to site settings, content modifications, or other administrative tasks that the privileged user is allowed to perform.
However, the impact is considered low and exploitation is unlikely due to the requirement of privileged user interaction and the low priority assigned to this issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the affected theme or seeking assistance from hosting providers or developers.