The vulnerability is a missing authorization flaw in Theme‑one The Grid plugin that allows an attacker to exploit incorrectly configured access control levels. Because the plugin does not enforce proper permissions, a user with lower privileges may gain access to administrative functions or content that should be restricted. This results in unauthorized data modification or exposure, compromising the integrity and confidentiality of the WordPress site.

Theme‑one’s The Grid plugin is affected in all releases prior to version 2.8.0, including any unspecified earlier build. Users running any version older than 2.8.0 are at risk, as the issue is present from the first available version up to just before 2.8.0.

The CVSS score of 8.8 marks this as a high‑severity vulnerability, and although the EPSS score is under 1 %, indicating a low probability of current exploitation, the flaw remains actionable. The vulnerability can be exploited remotely via web requests that the plugin processes, and it is not listed in the CISA KEV catalog. Attackers who can interact with the plugin’s endpoints can bypass role checks and elevate their privileges, potentially affecting the entire WordPress installation.