The vulnerability is an incorrect privilege assignment flaw in the ThemeOne The Grid WordPress plugin versions 2.8.0 and earlier. A subscriber user can exploit this defect to elevate their privileges within the WordPress site. The flaw falls under CWE‑266: Improper Privilege Management. The impact includes unauthorized changes to site content, configuration, or the granting of additional capabilities to other users. The result is loss of confidentiality, integrity, or availability depending on the actions performed by the compromised account.

The affected vendor is Theme‑One Inc. and the product is The Grid WordPress plugin. The vulnerability exists in all releases up to and including version 2.8.0. Any WordPress installation that has a subscriber account and has this plugin installed within the affected version range is vulnerable.

The CVSS score of 8.8 indicates high severity. Exploit availability is presently unknown, but the EPSS score indicates a very low probability of exploitation at 0.00306 (less than 1%). The vulnerability is not listed in CISA KEV. The attack vector is likely remote, requiring an authenticated subscriber account, which can be obtained through standard WordPress registration or other user creation mechanisms. An attacker could exploit the flaw by sending a crafted request to the plugin's endpoints, triggering the privilege escalation. Given the high CVSS rating and the potential for widespread exploitation, administrators should treat this as an urgent risk.