WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability

This CSRF vulnerability allows an attacker to craft malicious requests that, when triggered by a logged-in user of the Grand Magazine plugin, can modify site settings, create or delete content, or perform other actions that the user has permission to do. The attacker doesn't need to know the user's password, only that the user is logged in. The blast radius is limited to the scope of actions the user can perform within the plugin, but this could still have significant consequences depending on the user's role and privileges. Successful exploitation could lead to defacement, data modification, or unauthorized administrative access.

Websites using the Grand Magazine WordPress plugin, particularly those with users who have administrative or content creation privileges, are at risk. Shared hosting environments where multiple websites share the same server resources could also be affected if one site is vulnerable and an attacker can leverage it to target other sites on the same server.

• wordpress / composer / npm:

grep -r 'grandmagazine/grandmagazine' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep grandmagazine

• wordpress / composer / npm:

wp plugin update --all

1. 2026-04-08Disclosure

   disclosure

1. Réservé2026-04-07
2. Publiée2026-04-08
3. Modifiée2026-04-29
4. EPSS mis à jour2026-04-15

The primary mitigation is to upgrade the Grand Magazine plugin to a version that includes the fix. If upgrading immediately is not possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious CSRF tokens. Specifically, look for requests originating from different domains than the site itself. Additionally, ensure that all user input is properly validated and sanitized to prevent malicious data from being injected into requests. After upgrading, verify the fix by attempting to trigger a CSRF attack and confirming that the request is blocked or ignored.