CVE-2026-94169: WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/the-gridto a version that resolves this vulnerability.Fixed in 2.8.2
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects Theme-one The Grid versions through 2.8.1. The provided data does not identify a safe fixed version.
Can this be exploited remotely without authentication or user interaction?
Yes. The vector is network-based, attack complexity is low, and the CVSS metrics indicate no privileges and no user interaction are required.
What impact could successful exploitation have?
The vulnerability is classified as remote code execution through command injection. Its CVSS metrics indicate high impact to confidentiality, integrity, and availability, with scope changed.
Is the default configuration known to be affected?
The provided data does not state whether exploitation depends on a particular configuration or whether default installations are affected.