The Grid EUVD-2026-60890

Exploitation requires an authenticated WordPress user account at subscriber level or above - the lowest authenticated role in WordPress. On sites with open user registration enabled (a common configuration for membership, community, or e-commerce sites), any unauthenticated internet user can self-register to obtain this foothold. The plugin must be installed and active. No further special configuration, non-default settings, or specific deployment mode is required beyond the plugin's presence. The primary limiting factor is that sites with user registration disabled and no existing low-privileged accounts are not directly exploitable by external attackers without first compromising credentials through another vector. Internal threat actors (e.g., existing customers or members) with subscriber accounts face no such barrier.

The CVSS 8.8 score is substantiated by the attack vector breakdown: AV:N (exploitable over the network), AC:L (no special conditions beyond authentication), PR:L (only a subscriber account required), UI:N (no user interaction needed), with full C:H/I:H/A:H impact indicating complete confidentiality, integrity, and availability compromise if privilege escalation reaches administrator level. The low-complexity, network-exploitable nature with only subscriber-level authentication is the critical risk multiplier - on WordPress sites with open registration, any internet user can obtain the required foothold trivially. No EPSS data was provided, and no CISA KEV listing exists, so exploitation frequency cannot be quantified. No POC code has been identified in the provided intelligence. Real-world risk is high for sites with open registration enabled; sites that disable new user registration or have no subscriber-level accounts reduce exposure significantly. The absence of a confirmed fixed version in the provided data is a notable gap that defenders should resolve before making patching decisions.

An attacker registers a free subscriber account on a WordPress site running The Grid ≤ 2.7.9.1, then sends a crafted authenticated HTTP request - likely to a plugin AJAX handler or REST endpoint - that triggers the improper privilege assignment flaw, elevating the attacker's role to administrator. With administrator access, the attacker can install malicious plugins, create backdoor accounts, exfiltrate the database, or achieve full server compromise via theme or plugin code execution.