The Grid WordPress plugin: Unauthenticated remote code execution
Summary
The Grid is a commercial WordPress plugin by Theme-one. Versions up to and including 2.8.1 contain a code injection flaw (CWE-94) that lets unauthenticated remote attackers run commands on the server. Patchstack rates it critical (CVSS 10.0), and the NVD record is still deferred, so the score is the CNA's. A public detection template exists and VulnCheck lists it as known exploited, but in-the-wild exploitation is not verified.
Affected
- The Grid plugin by Theme-one, all versions up to and including 2.8.1
- Lowest affected version: Unknown.
Fixed in
- Version 2.8.2 or later (per Patchstack and the vendor changelog)
Workaround
- No vendor workaround found.
- If an update is not possible right away: deactivate the plugin and restrict access to it. This is a recommendation, not a vendor instruction.
Exploitation
- VulnCheck KEV lists the vulnerability; CVSS 10, EPSS 0.00985.
- A public Nuclei detection template for unauthenticated code injection exists. It is not a confirmed exploit.
- CISA KEV status: Unverified.
- Strix reports KEV: No; TheHackerWire reports no confirmed public exploit code. These are aggregators.
- Confirmed in-the-wild exploitation: Unverified.
Our recommendation
- Check all WordPress sites for The Grid and its version.
- Update to version 2.8.2 or later immediately.
- If an update is not possible, deactivate the plugin.
- Review sites for signs of compromise, such as unexpected files or admin accounts.
- Monitor for further advisories and exploitation reports.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
kize7/CVE-2026-94169
Research sources
- Patchstack advisory: The Grid <= 2.8.1 RCE patchstack.com
- The Grid on CodeCanyon (vendor changelog) codecanyon.net
- VulDB: CVE-2026-94169 vuldb.com
- VulnCheck KEV entry (Vulners) vulners.com
- Strix CVE summary www.strix.ai
- TheHackerWire: CVE-2026-94169 www.thehackerwire.com
- Nuclei templates releases github.com
- Offseq threat radar: CVE-2026-94169 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:14.
Original description (NVD)
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.