The Grid CVE-2026-24369

Requires authenticated user access to Theme-one The Grid WordPress plugin versions before 2.8.0. Attacker must be logged in with low-privilege user account (PR:L). No victim interaction needed. Exploits improperly configured access control on Grid functionality.

Without an assigned CVSS score or EPSS probability data, assessment relies on contextual factors: CWE-862 (Missing Authorization) is consistently high-risk in real-world exploitation, as access control bypasses directly enable privilege escalation and data theft. The authentication bypass tag indicates this is not a theoretical issue but a practical weakness. The existence of a patch (version 2.8.0) and ENISA tracking suggest vendor acknowledgment of real risk. Given WordPress plugin ubiquity and the straightforward nature of authorization flaws (typically automatable), this warrants immediate attention despite absent CVSS/EPSS metrics. The lack of CVSS assignment may reflect the CVE's recent publication date (2026 designation) rather than low severity. Real-world risk is moderate-to-high for any installation not yet patched.

An unauthenticated attacker or low-privilege user (such as a subscriber or contributor role) accesses The Grid plugin's admin functions directly via HTTP requests, bypassing the intended WordPress capability checks. Due to the missing authorization controls, the plugin processes these requests without validating the user's actual role or permissions, allowing the attacker to modify grid content, change configuration settings, or extract sensitive data. This could be automated using simple scripts to enumerate and exploit the access control weakness across multiple WordPress installations.