CVE-2026-40730

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
ThemeGrill	ThemeGrill Demo Importer	<= 2.0.0.6

References

https://patchstack.com/database/Wordpress/Plugin/themegrill-demo-importer/vulnerability/wordpress-themegrill-demo-importer-plugin-2-0-0-6-broken-access-control-vulnerability?_s_id=cve

Timeline

Published: Apr 15, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-407318.1Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.CVE-2026-407327.1Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.CVE-2026-407338.1Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.CVE-2026-407346.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-im CVE-2026-407358.1Unauthenticated PHP Object Injection in Reina <= 2.1 versions.CVE-2026-407368.1Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.CVE-2026-407375.3Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly CVE-2026-407388.1Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.CVE-2026-407398.1Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.CVE-2026-40746.4The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attribu CVE-2026-407405.4Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-407417.5Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.