{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24369", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-22T14:42:32.873Z", "datePublished": "2026-03-25T16:14:31.699Z", "dateUpdated": "2026-09-01T14:42:38.646Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-01T14:42:38.646Z"}, "title": "WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "ThemeOne", "product": "The Grid", "versions": [{"status": "affected", "version": "n/a", "lessThanOrEqual": "2.8.0", "changes": [{"at": "2.8.1", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects The Grid: from n/a through 2.8.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects The Grid: from n/a through 2.8.0.</p>"}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-0-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}}], "solutions": [{"lang": "en", "value": "Update the WordPress The Grid plugin to the latest available version (at least 2.8.1).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress The Grid plugin to the latest available version (at least 2.8.1)."}]}], "credits": [{"lang": "en", "value": "Phat RiO | Patchstack Bug Bounty Program", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T19:43:05.178020Z", "id": "CVE-2026-24369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:00:56.714Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24369", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:43:05.178020Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:41:43.188Z"}}], "cna": {"title": "WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ThemeOne", "product": "The Grid", "versions": [{"status": "affected", "changes": [{"at": "2.8.1", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "2.8.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress The Grid plugin to the latest available version (at least 2.8.1).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress The Grid plugin to the latest available version (at least 2.8.1).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-0-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects The Grid: from n/a through 2.8.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects The Grid: from n/a through 2.8.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-01T14:42:38.646Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24369", "state": "PUBLISHED", "dateUpdated": "2026-09-01T14:42:38.646Z", "dateReserved": "2026-01-22T14:42:32.873Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:31.699Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "The Grid", "vendor": "ThemeOne", "versions": [{"changes": [{"at": "2.8.1", "status": "unaffected"}], "lessThanOrEqual": "2.8.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects The Grid: from n/a through 2.8.0."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Theme-one The Grid the-grid permite explotar niveles de seguridad de control de acceso incorrectamente configurados. Este problema afecta a The Grid: desde n/a hasta &lt; 2.8.0."}], "id": "CVE-2026-24369", "lastModified": "2026-09-01T15:17:14.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24369", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T19:43:05.178020Z", "version": "2.0.3"}}]}, "published": "2026-03-25T17:16:37.383", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-0-broken-access-control-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "The Grid", "source": "cna", "vendor": "Theme-one"}, "product": "the_grid", "vendor": "theme-one"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-26T22:08:33.963029+00:00", "value": {"mitigation_remediation": ["Update Theme-one The Grid to version 2.8.0 or newer immediately.", "Check plugin access control settings to ensure only administrators have permission to use the plugin.", "Audit existing user roles and remove any unnecessary capabilities that grant access to the plugin.", "If an upgrade cannot be performed right away, disable the plugin for all non-admin roles until a fix is applied.", "Monitor site logs for unusual activity involving the plugin\u2019s endpoints."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "All WordPress installations that use Theme-one The Grid plugin version 2.7.x or earlier are vulnerable. The plugin\u2019s affected range spans from its first release through any version prior to 2.8.0, regardless of the underlying WordPress version.", "description_and_impact": "A missing authorization flaw in the Grid plugin enables attackers to access or modify plugin data and site content that should be restricted. This broken access control leads to unauthorized changes, potentially compromising the entire site. The weakness is categorized as CWE-862.", "risk_and_exploitability": "The CVSS score of 7.1 indicates medium\u2011high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA\u2019s KEV catalog and no public exploits are documented. The likely attack vector is inferred from the missing authorization description: attackers can execute privileged operations by sending authenticated requests to the plugin\u2019s API endpoints, which may be accessible to any user role that receives elevated capabilities."}}}}, "created": "2026-03-25T21:34:49.833280+00:00", "updated": "2026-03-27T09:46:28.947437+00:00", "vendors": ["theme-one", "theme-one$PRODUCT$the_grid", "wordpress", "wordpress$PRODUCT$wordpress"]}