CVE-2026-94169
10.0CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-94
Impact
Unauthenticated attackers can execute arbitrary commands on the web server over the network. They need only HTTP access to the target WordPress site.
Root cause
Improper sanitization of user input allows code and command injection in the plugin.
Affected systems
Theme-one The Grid plugin through 2.8.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade to a version newer than 2.8.1 if available; otherwise, deactivate and uninstall the plugin immediately via the WP-CLI or admin dashboard.
$ wp plugin deactivate the-grid --uninstallAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.