This vulnerability is an improper control of code generation flaw that allows an attacker to inject arbitrary code through the Theme‑one The Grid plugin. The flaw enables command injection, giving the attacker the ability to execute arbitrary system commands on the host web server. The weakness maps to CWE‑94 and is described as a code injection vulnerability. The impact includes complete loss of confidentiality, integrity, and availability for affected sites, potentially allowing an attacker to compromise the entire WordPress installation.

The affected product is the WordPress The Grid plugin developed by Theme‑one. Versions from the earliest available release up to and including 2.8.1 are impacted, while 2.8.2 and later are considered fixed.

The CVSS score of 10 indicates the highest severity possible, and the EPSS score is 4%, implying a very low but nonzero probability of exploitation; the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote, as the plugin is accessible through the WordPress administrative interface or via public plugin endpoints. An attacker with remote access to the WordPress site can trigger the code injection and gain full server compromise. The vulnerability has no documented mitigations beyond patching and is not in a public exploitation catalog.