CVE-2026-28191: WordPress The Grid plugin <= 2.7.9.1 - Privilege Escalation vulnerability

Q: Which deployments are affected?

Sites using The Grid plugin version 2.7.9.1 or earlier are affected. The issue is in a WordPress plugin and concerns escalation from the Subscriber role.

Q: What access does an attacker need?

The vector is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an existing low-privileged account, such as a Subscriber account, to exploit it.

Q: What can be done if an update cannot be applied immediately?

The provided data does not identify a fixed version, workaround, or mitigation. If patching cannot be performed immediately, no specific compensating control can be confirmed from the available information.

Published Aug 18, 2026

Updated

Subscriber Privilege Escalation in The Grid <= 2.7.9.1 versions.

Affected Software

1 affected component

WordPress The Grid plugin<=2.7.9.1

Event History

Aug 18, 2026

CVE Published

via MITRE·01:59 PM

Data Sourced

via MITRE·01:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Sites using The Grid plugin version 2.7.9.1 or earlier are affected. The issue is in a WordPress plugin and concerns escalation from the Subscriber role.

What access does an attacker need?

The vector is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an existing low-privileged account, such as a Subscriber account, to exploit it.

What can be done if an update cannot be applied immediately?