CVE-2026-66652: CWE-352 Cross-Site Request Forgery (CSRF) in ThemeGoods Grand Tour

This vulnerability is a CWE-352 Cross-Site Request Forgery issue in the ThemeGoods Grand Tour plugin. It affects versions up to and including 5.5.1. The vulnerability allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to unauthorized actions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions within the Grand Tour plugin. The impact includes low integrity and low availability impacts but no confidentiality loss. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying request origins or using tokens if possible. Monitor vendor communications for updates.