A Server‑Side Request Forgery flaw exists in the Grand Blog theme before version 3.1.5 that allows a malicious actor to instruct the WordPress site to make arbitrary HTTP requests on its behalf. The vulnerability is rooted in unchecked input that the theme forwards to external URLs, enabling a malicious request to be crafted. This can compromise confidentiality, integrity, or availability of internal resources, and may be leveraged to build further attacks such as pivoting into company‑internal services or exfiltrating data.

The problem affects the Grand Blog theme provided by ThemeGoods. All installations using any Grand Blog version from the earliest release through the latest unreleased 3.1.5 are susceptible. The exact version range is not listed beyond “< 3.1.5.”

The CVSS score of 5.4 indicates a moderate risk, and the EPSS of less than 1% suggests that, at present, exploitation likelihood is very low. The issue is not in the CISA KEV catalog. Attackers would need to supply a URL that the theme processes; because the theme accepts arbitrary URLs, the attack vector is likely web‑based within the WordPress administration interface or via crafted requests to the theme’s endpoints. No publicly available exploits are known, but the potential for abuse exists if an attacker can influence request parameters.