Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

The Grid WordPress plugin can let attackers run code

CVE-2026-94169 · published 2 days ago
Summary

The Grid plugin for WordPress, up to version 2.8.1, can be tricked into executing commands from a website visitor. This could allow an attacker to take control of the server hosting your site. Update the plugin to a newer version or remove it if you cannot upgrade.

What to do
  • Update theme-one the grid to version 2.8.2.
Affected software
VendorProductAffected versions
theme-one the grid <= 2.8.1
Fix: upgrade to 2.8.2
Original advisory text
WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen16 Oct 2026
Sources
CVE-2026-94169 · NVD
CVE-2026-94169 · MITRE
Track software like this
Free during beta