A cross‑site request forgery flaw exists in the Grand Portfolio WordPress theme. The vulnerability allows an attacker to trick an authenticated administrator or content author into loading a malicious page that silently submits requests to the site. Those requests can invoke theme functions, enabling unauthorized modification of theme settings or content. The result is a loss of integrity of the site’s appearance and data.

All versions of the Grand Portfolio theme distributed by ThemeGoods, from the first release up to and including version 3.3, are susceptible.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests currently low exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The flaw can be exploited by directing a victim’s browser to perform a request that the theme accepts, assuming the user is authenticated and has sufficient privileges. The likely attack vector is a malicious link or script that triggers such a request from the victim’s browser. Because the weakness is a lack of protection against CSRF, any authenticated user with access to the theme’s administrative functions is a potential target.