CVE-2026-24961: 
WordPress vulnerability analysis and mitigation

CVE-2026-24961 is a Server-Side Request Forgery (SSRF) vulnerability in the ThemeGoods Grand Blog WordPress theme that allows unauthenticated remote attackers to induce the server to make requests to arbitrary external domains. It affects Grand Blog versions prior to 3.1.5 and was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on December 3, 2025, with public disclosure on January 2, 2026. The vulnerability was assigned a CVSS v3.1 base score of 5.4 (Medium) (Patchstack).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the Grand Blog theme fails to properly validate or restrict user-supplied URLs before making server-side HTTP requests. An unauthenticated attacker can craft a network request that causes the WordPress server to fetch resources from an arbitrary domain controlled by the attacker. No user interaction is required, though exploitation has high attack complexity. No public technical write-up or proof-of-concept code has been identified beyond the Patchstack advisory (Patchstack).

Successful exploitation could allow an attacker to cause the affected WordPress server to issue HTTP requests to arbitrary internal or external hosts, potentially exposing sensitive information from internal services (e.g., cloud metadata endpoints, internal APIs) not otherwise accessible from the internet. The CVSS assessment indicates low confidentiality and low integrity impact with no availability impact, and the scope is changed, meaning the impact can extend beyond the vulnerable component itself. Patchstack notes this vulnerability type is commonly used in mass-exploit campaigns targeting large numbers of WordPress sites regardless of their size or popularity (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.035% (0.000350), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as low, noting it is unlikely to be exploited despite the SSRF class being associated with mass-exploit campaigns (Patchstack).

The vendor has released Grand Blog version 3.1.5, which patches this vulnerability. Users should update the Grand Blog WordPress theme to version 3.1.5 or later immediately. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance, and consider using a WordPress security plugin such as Patchstack to apply virtual patching (Patchstack).