The vulnerability is a classic CSRF flaw in the Grand Car Rental theme, disclosed for all versions up to 3.6.9. By sending a crafted request from a malicious site, an attacker can cause an authenticated user to trigger unintended actions within the theme or website, potentially modifying data or settings without that user’s knowledge. The weakness corresponds to CWE‑352, a cross‑site request forgery vulnerability.

The affected system is the Grand Car Rental theme provided by ThemeGoods. Any WordPress installation that uses this theme in a version equal to or older than 3.6.9 is impacted. No further sub‑versions are specified, so all releases up through 3.6.9 are covered. If the site runs a newer theme version, it is not affected.

The CVSS score of 6.5 places the issue in the medium severity range. The EPSS score below 1 percent indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the target user is authenticated to the site and visits a malicious page that submits a request that the theme accepts. Because the attack is web‑based and does not require privileged local access, the attack vector is considered network and possible to conduct from any remote computer that can reach the site.