The vulnerability is a missing authorization flaw in the ThemeGrill Demo Importer WordPress plugin that allows an attacker to exploit incorrectly configured access control levels and perform administrative actions within the plugin without proper authentication, potentially exposing sensitive data or enabling further exploitation.

ThemeGrill Demo Importer plugin for WordPress, all versions up to and including 2.0.0.6. The affected software is distributed under the name ThemeGrill Demo Importer; no additional version details beyond the upper bound are provided.

Based on the description, it is inferred that an attacker would target the plugin’s import endpoint by sending a crafted HTTP request directly to the import URL or via a form in the WordPress administrative interface. Because the flaw requires no authentication, it is inferred that any user who can reach the affected site—whether authenticated or not—could trigger the import action and access administrative capabilities. The missing authorization control (CWE-862) represents a high‑impact security weakness that can lead to full privilege escalation on the WordPress installation. The EPSS score is <1% and the CVSS score is 5.3, indicating a moderate risk that is currently not widely exploited.