CVE-2026-28191

WordPress The Grid plugin <= 2.7.9.1 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in The Grid <= 2.7.9.1 versions.

We have discovered 7,681 live websites that are affected by CVE-2026-28191.

Run a Free Instant Scan



Affected Software

Product  The Grid Plugin
Category Wordpress Plugins
Vulnerable Domains7,681 live websites (75% of The Grid Plugin install base)
Vulnerable Versions
  • from 0 through 2.7.9.1
Vulnerable Versions Count40 versions ( 91% of all versions)


Common Weakness Enumeration

CWE-266 Incorrect Privilege Assignment



Details

  • Published - Aug 18, 2026
  • Updated - Aug 18, 2026

Credits

  • Phat RiO | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-28191
United States2,547 websites


Germany740 websites
France465 websites
Italy393 websites
GB379 websites
Canada286 websites
Spain225 websites
Australia194 websites
Netherlands170 websites
Switzerland134 websites

Website Distribution by TLD

Number of websites using CVE-2026-28191
.com3,483 websites
.org364 websites
.de331 websites
.it265 websites
.co.uk237 websites
.fr183 websites
.at171 websites
.com.au162 websites
.ca153 websites
.nl146 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-28191

Top websites that are affected by CVE-2026-28191. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.com United States**,***
***************.com Bulgaria**,***
*****************.com United States**,***
*****************.com United States**,***
*****.nl Netherlands**,***
***.***.pl Poland**,***
**************.ca Canada***,***
****.***.hk Hong Kong***,***
*********.com Singapore***,***
***********.org United States***,***
See full domain list

FAQ

CVE-2026-28191 is Incorrect Privilege Assignment in The Grid Plugin
A total of 7,681 websites have been identified as vulnerable to CVE-2026-28191, based on global website indexing conducted by WebTechSurvey.
The The Grid Plugin is affected by the CVE-2026-28191 vulnerability.
The Grid Plugin versions up to and including 2.7.9.1 are vulnerable to CVE-2026-28191.