The updated description states that the vulnerability is a missing authorization flaw in ThemeOne The Grid that allows exploitation of incorrectly configured access control security levels. As a result, users with lower privileges could gain unauthorized access to administrative functions or content that should be protected. This can lead to unauthorized data modification or exposure, thereby compromising the site’s integrity and confidentiality.

Theme‑one’s The Grid plugin is affected in all releases prior to version 2.8.0, including any unspecified earlier build. Users running any version older than 2.8.0 are at risk, as the issue is present from the first available version up to just before 2.8.0.

The CVSS score of 5.3 marks this as a medium‑severity vulnerability, and although the EPSS score is under 1 %, indicating a low probability of current exploitation, the flaw remains actionable. The vulnerability can be exploited remotely via web requests that the plugin processes, and it is not listed in the CISA KEV catalog. Attackers who can interact with the plugin’s endpoints can bypass role checks and elevate their privileges, potentially affecting the entire WordPress installation.