Description

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T12:17:12.127Z",
  "pubdate": "2026-09-02T12:17:12.127Z",
  "executiveSummary": "The Grand Tour theme for WordPress, specifically versions n/a through 5.5.1, contains a Cross-Site Request Forgery (CSRF) vulnerability.\nThis vulnerability allows an unauthenticated remote attacker to induce an authenticated user, typically an administrator, to perform unintended actions within the application context.\nThe core issue stems from the application's failure to properly validate or enforce anti-CSRF tokens for sensitive state-changing requests.\nSuccessful exploitation could result in unauthorized administrative operations, such as modifying site settings, creating new users, or injecting malicious content, depending on the functionality exposed through the vulnerable endpoints.\nThe attack requires the victim to be actively authenticated and enticed to visit a malicious site or interact with a crafted link, after which the browser automatically includes the victim's session cookies in the forged request.\nThe impact is significant, as it can lead to full administrative compromise if the target is an administrator, posing severe risks to the confidentiality, integrity, and availability of the affected WordPress installation.",
  "technicalDetails": "The vulnerability resides in the ThemeGoods Grand Tour theme, affecting all versions from n/a up to and including 5.5.1.\nThe root cause of the vulnerability is the absence of secure, unpredictable anti-CSRF tokens (often referred to as nonces in the WordPress ecosystem) for critical state-changing actions.\nIn a CSRF attack, the server-side application relies solely on ambient credentials—such as session cookies—to verify the identity of the requester. Because browsers automatically include these cookies with cross-site requests, the application cannot distinguish between a legitimate request originated from the intended interface and a forged request initiated by a third-party domain controlled by an attacker.\nThe attack flow begins when an attacker crafts a malicious web page or an email containing an HTML form or an automated script (e.g., using fetch or XMLHttpRequest) that targets the vulnerable endpoints of the Grand Tour theme.\nWhen an authenticated administrator visits the attacker-controlled page, the script executes, sending a forged HTTP request to the victim's WordPress site.\nSince the application does not verify the presence or validity of a cryptographically secure token, it processes the request as if it were a legitimate administrative action.\nBecause the request is executed within the context of the administrator's authenticated session, the application honors the command, potentially leading to unauthorized system modifications.\nThe vulnerability is persistent across the specified versions, indicating a systemic lack of CSRF protection mechanisms in the theme's administrative or settings-related functions.\nPost-exploitation impact is contingent upon the specific functionality targeted by the attacker. If the CSRF-vulnerable endpoint manages theme configurations or plugin settings, the attacker could effectively escalate privileges, manipulate site content, or establish persistent backdoors by injecting malicious scripts into the database.\nThis vulnerability does not require prior knowledge of the victim's credentials, as the victim's browser performs the authentication handshake automatically. However, the requirement for an authenticated user to be active at the time of exploitation represents a primary constraint on the attack surface."
}