CVE-2026-11359: Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation
The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the pginstallprofilegrid() AJAX handler registered via wpajaxpginstallprofilegrid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ProfileGrid plugin from wordpress.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate by ensuring only administrators (or users without Subscriber+ access) can access functionality that would trigger the wp_ajax_pg_install_profilegrid() AJAX handler; since the issue is unauthorized plugin installation/activation by authenticated Subscriber+ users, restrict the ability to invoke this AJAX action to trusted roles.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11359?
The severity of CVE-2026-11359 is medium with a score of 4.3.
How do I fix CVE-2026-11359?
To fix CVE-2026-11359, upgrade the Memberships and User Profiles for WooCommerce plugin to a version higher than 3.4.
What does CVE-2026-11359 affect?
CVE-2026-11359 affects the Memberships and User Profiles for WooCommerce plugin for WordPress.
What is the risk associated with CVE-2026-11359?
The risk associated with CVE-2026-11359 includes unauthorized plugin installation and activation due to missing authorization checks.
Who is affected by CVE-2026-11359?
Users with an authenticated role of Subscriber or higher can potentially exploit CVE-2026-11359.