A missing authorization flaw in the Grid plugin enables attackers to access or modify plugin data and site content that should be restricted. This broken access control leads to unauthorized changes, potentially compromising the entire site. The weakness is categorized as CWE-862.

All WordPress installations that use Theme-one The Grid plugin version 2.7.x or earlier are vulnerable. The plugin’s affected range spans from its first release through any version prior to 2.8.0, regardless of the underlying WordPress version.

The CVSS score of 7.1 indicates medium‑high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog and no public exploits are documented. The likely attack vector is inferred from the missing authorization description: attackers can execute privileged operations by sending authenticated requests to the plugin’s API endpoints, which may be accessible to any user role that receives elevated capabilities.