The vulnerability identified as CVE-2026-25391 affects the WP Grids WP Wand plugin for WordPress, specifically versions up to and including 1.3.07. It is characterized by missing authorization checks within the ai-content-generation functionality, which results in incorrectly configured access control security levels. This can allow an attacker with some privileges to perform unauthorized actions that may impact the integrity and availability of the affected system. The CVSS v3.1 base score is 5.4, indicating a medium severity level. No patch or official remediation guidance is currently provided, and the product is not a cloud service.

The vulnerability can lead to unauthorized modification or disruption of the affected system's functionality due to missing authorization controls. The CVSS vector indicates network attack vector, low attack complexity, requires privileges, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin features to trusted users only and monitor for unusual activity related to WP Wand. Avoid granting unnecessary privileges to users who can interact with the plugin.