The vulnerability is a missing authorization flaw in the ThemeGrill Demo Importer WordPress plugin that allows an attacker to exploit incorrectly configured access control levels and perform administrative actions within the plugin without proper authentication, potentially exposing sensitive data or enabling further exploitation.

ThemeGrill Demo Importer plugin for WordPress, all versions up to and including 2.0.0.6. The affected software is distributed under the name ThemeGrill Demo Importer; no additional version details beyond the upper bound are provided.

The CVE does not list an EPSS score or inclusion in the CISA KEV catalog, indicating that exploitation trends are not known to be widespread. Based on the description, it is inferred that an attacker can access the plugin’s import endpoint by sending a crafted HTTP request directly to the import URL or by submitting a form within the WordPress administrative interface. Because the flaw requires no authentication, any actor who can reach the affected site—whether authenticated or not—could trigger the import action and gain access to administrative capabilities. The missing authorization control (CWE‑862) represents a high‑impact security weakness that can lead to full privilege escalation on the WordPress installation.