CVE-2026-39635: CSRF in Grand Magazine WordPress Plugin

This CSRF vulnerability allows an attacker to craft malicious requests that, when triggered by a logged-in user of the Grand Magazine plugin, can modify site settings, create or delete content, or perform other actions that the user has permission to do. The attacker doesn't need to know the user's password, only that the user is logged in. The blast radius is limited to the scope of actions the user can perform within the plugin, but this could still have significant consequences depending on the user's role and privileges. Successful exploitation could lead to defacement, data modification, or unauthorized administrative access.

1. Reserved2026-04-07
2. Published2026-04-08
3. Modified2026-04-29
4. EPSS updated2026-04-15

The primary mitigation is to upgrade the Grand Magazine plugin to a version that includes the fix. If upgrading immediately is not possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious CSRF tokens. Specifically, look for requests originating from different domains than the site itself. Additionally, ensure that all user input is properly validated and sanitized to prevent malicious data from being injected into requests. After upgrading, verify the fix by attempting to trigger a CSRF attack and confirming that the request is blocked or ignored.