# CVE-2026-66652: ThemeGoods Grand Tour cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-66652-themegoods-grand-tour-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66652 · Severity: medium · CVSS 5.4 · Published 2026-09-02

Grand Tour is a WordPress theme used to build and manage website content and appearance. A cross-site request forgery (CSRF) vulnerability allows attackers to trick logged-in administrators into performing unintended actions—such as changing settings, deleting content, or modifying site configuration—without their knowledge or consent. This could compromise site integrity and administrator accounts.

Vendors: [ThemeGoods](https://junglewise.ai/threats/vendors/themegoods).

## Quick answers

**Is CVE-2026-66652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66652 being exploited in the wild.

**How severe is CVE-2026-66652?** Medium severity, with a CVSS score of 5.4, published 2 September 2026.

**Which products and versions are affected?** ThemeGoods Grand Tour through 5.5.1.

**Is there a fix for CVE-2026-66652?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66652 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-66652?** Check whether you run ThemeGoods Grand Tour at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Grand Tour WordPress theme versions 5.5.1 and earlier contain a cross-site request forgery vulnerability that allows unauthenticated attackers to craft malicious web pages or links that, when clicked by a logged-in administrator, trigger unwanted administrative actions. The vulnerability exploits the absence of proper CSRF token validation on sensitive operations. Successful exploitation requires user interaction (a logged-in user must visit a malicious page or click a crafted link). The impact includes unauthorized modification of site settings and potential administrative account compromise. No official patch is currently available; administrators should update to a patched version or implement additional security controls.

## Affected products

- ThemeGoods Grand Tour through 5.5.1

## Timeline

- 2026-01-02: disclosed: Reported to Patchstack
- 2026-09-02: advisory: Published by Patchstack and NVD

## References

- [https://patchstack.com/database/wordpress/theme/grandtour/vulnerability/wordpress-grand-tour-theme-5-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/theme/grandtour/vulnerability/wordpress-grand-tour-theme-5-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)