ThemeGrill Demo Importer (themegrill-demo-importer) is affected by a broken access control (“missing authorization”) vulnerability. The issue allows an attacker to perform actions that should be restricted to authorized users, due to incorrectly configured access control security levels. The affected versions are from “n/a” through <= 2.0.0.6, and the issue is addressed by updating to version 2.0.0.7 or later.
The root cause is a missing or incorrect authorization check in the plugin’s request handling logic (CWE-862: Missing Authorization). In plain terms, a function that should verify the caller’s permissions does not properly enforce them, which can allow an unprivileged user to trigger higher-privileged behavior. The provided reference does not include specific function names, code paths, or a detailed exploitation workflow (e.g., which endpoint/action is abused), but it clearly characterizes the flaw as “Broken Access Control” where an authorization/permission/nonce-style gate is absent or misconfigured.
Impact is primarily unauthorized execution of privileged actions within the WordPress plugin context. The Patchstack reference indicates a CVSS score of 5.3 and describes this as a broken access control issue that could be leveraged in mass-exploit campaigns, though it also states the severity impact is low and that it is unlikely to be exploited. Practically, the blast radius is limited to sites running the vulnerable ThemeGrill Demo Importer plugin versions (<= 2.0.0.6), where an attacker could attempt to invoke restricted functionality without proper permissions.
Mitigation: update the ThemeGrill Demo Importer plugin to version 2.0.0.7 or later. If immediate updating is not possible, the reference recommends asking the hosting provider or web developer for help. As an operational control, Patchstack users can enable auto-update for vulnerable plugins only. Detection guidance is not provided in the supplied references; the most reliable remediation is version upgrade to >= 2.0.0.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-862