EUVD-2026-102812
GHSA-mx9f-gh9h-q5j2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using The Grid ≤2.8.1
-
DeliverySend crafted request to vulnerable endpoint
-
ExploitInject commands via code-generation path
-
ExecutionExecute arbitrary code on web server
-
ImpactFull WordPress/host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress installation running the Theme-one 'The Grid' plugin at version 2.8.1 or earlier; the flaw is a code/command injection in the plugin, so reaching the vulnerable grid-generation code path is the prerequisite. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and needs no user interaction; however the description does not name the specific endpoint, parameter, or whether authentication is truly required, so the unauthenticated claim should be verified against the Patchstack advisory. The principal limiting factor is simply having the vulnerable plugin installed and active - no non-default configuration is explicitly stated. |
| Impact | This is a genuine high-priority vulnerability on raw severity signals: the provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates 10.0 Critical, indicating a network-reachable, low-complexity, no-privilege, no-interaction command injection (CWE-94) yielding full confidentiality, integrity and availability loss with scope change. The vulnerability class (OS/code command injection leading to RCE) is among the most impactful. However, several corroborating real-world signals are MISSING: no EPSS exploitation-probability score was supplied, the CVE is NOT listed in CISA KEV, and no public POC/exploit code is referenced - the only source is a single Patchstack database entry. So while the technical ceiling is maximal, there is currently no evidence of active or at-scale exploitation; treat it as a patch-urgently-but-not-yet-known-exploited issue. One caveat to verify: the PR:N (unauthenticated) rating comes from Patchstack's vector, but the description gives no detail on required privileges and uses the 'from n/a' affected-version convention; the actual authentication prerequisite should be confirmed against the Patchstack advisory before assuming fully unauthenticated RCE. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to a WordPress site running The Grid plugin (≤2.8.1), injecting commands into a vulnerable code-generation/parameter path. Because the CVSS vector indicates network vector, low complexity, and no user interaction, the request executes attacker-controlled code or OS commands on the web server, leading to full site and potentially host compromise. No public exploit code is identified at time of analysis, so a working exploit would currently need to be developed from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Remote code execution in the Theme-one The Grid WordPress plugin through version 2.8.1 allows network attackers to inject code or commands via the plugin's grid-generation code path, with the supplied CVSS:3.1 vector indicating AV:N/AC:L/PR:N/UI:N (unauthenticated and no user interaction per the vector, though the exact endpoint and authentication prerequisite should be verified in the Patchstack advisory). The provided vector rates this as 10.0 Critical with full confidentiality, integrity, and availability impact, while our independent assessment adjusts scope from Changed to Unchanged but still considers impact High. No public exploit identified at time of analysis, and no KEV or EPSS data was provided.
RemediationAI
Upgrade The Grid plugin beyond version 2.8.1 as soon as a fixed release is available; the provided data does not list an exact patched version, so verify the fixed version in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-1-remote-code-execution-rce-vulnerability?_s_id=cve. If no patch is available or immediate upgrade is not possible, deactivate and remove The Grid plugin, which removes exposure but disables grid layout functionality. Restrict network access to the vulnerable plugin code path and apply WAF or virtual patching rules targeting code or command injection in The Grid; WAF mitigation may not catch all obfuscated payloads and can produce false positives. Monitor WordPress and server logs for exploitation attempts and review installed plugin versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a WordPress plugin, Theme-one The Grid, which builds grid layouts and generates dynamic output; the vulnerability is CWE-94, Improper Control of Generation of Code ('Code Injection'), meaning attacker-controlled input can reach code or command generation logic without proper neutralization, resulting in command injection. The supplied data does not include CPE strings or identify a specific parameter, so the vulnerable entry point is described only as the plugin's grid-generation path. The provided CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0 Critical); the independent assessment uses S:U and still treats C/I/A as High, so the practical prerequisite is an active vulnerable plugin on a WordPress site, and the unauthenticated remote claim should be confirmed against the Patchstack advisory.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network command injection with no interaction yields full CIA impact; I assess scope Unchanged (RCE within the web-app context) rather than Patchstack's S:C, pending endpoint detail, and keep PR:N as reported though it is unconfirmed.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Executive ViewAI
The Theme-one The Grid WordPress plugin, versions through 2.8.1, contains a critical unauthenticated remote code execution flaw that can let any network attacker take full control of affected WordPress sites. Because exploitation requires no credentials or user interaction, the organization faces potential data theft, site defacement, malware distribution, and regulatory exposure until all vulnerable deployments are contained. Leadership should treat this as a severe operational and reputational risk and prioritize discovery, removal, or mitigation of the plugin across the entire web estate.
No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or removing the Theme-one The Grid plugin at versions through 2.8.1, applying WAF or virtual patching rules to block the vulnerable grid-generation code path, restricting access to WordPress administrative interfaces, enforcing least privilege, enabling detailed logging and monitoring for exploitation attempts, and isolating affected sites until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB