CVE-2026-94169
published 2026-10-16CVE-2026-94169: Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid…
PriorityP189critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
4.42%
91.3th percentile
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| theme-one | the_grid | <= 2.8.1 | — |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
ghsa_unreviewed·2026-10-16
CVE-2026-94169 [CRITICAL] CWE-94 Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
VulnCheck
Improper Control of Generation of Code ('Code Injection')
vulncheck·2026·CVSS 10.0
CVE-2026-94169 [CRITICAL] Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-1-remote-code-execution-rce-vulnerability
No detection rules found.
Nuclei
The Grid <= 2.8.1 - Unauthenticated Code Injection
nuclei·CVSS 10.0
CVE-2026-94169 [CRITICAL] The Grid <= 2.8.1 - Unauthenticated Code Injection
The Grid <= 2.8.1 - Unauthenticated Code Injection
Theme-one The Grid <= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.
Template:
id: CVE-2026-94169
info:
name: The Grid <= 2.8.1 - Unauthenticated Code Injection
author: 0x_Akoko
severity: critical
description: |
Theme-one The Grid <= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.
impact: |
Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.
remediation: |
Update to the latest version beyond 2.8.1.
reference:
- https://patchstack.com/database/wordpress
No writeups or analysis indexed.
2026-10-16
Published
Exploited in the wild