CVE-2026-11359 Overview
CVE-2026-11359 affects the Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress in versions up to and including 3.4. The vulnerability allows authenticated attackers with Subscriber-level access or above to install and activate the ProfileGrid plugin from wordpress.org without authorization. The flaw stems from a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. The issue is classified under [CWE-862] Missing Authorization.
Critical Impact
Low-privileged authenticated users can install and activate an additional WordPress plugin on the target site, expanding the attack surface without administrator consent.
Affected Products
- Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress
- All versions up to and including 3.4
- WordPress sites running the plugin with Subscriber-level or higher user registration enabled
Discovery Timeline
- 2026-07-09 - CVE-2026-11359 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-11359
Vulnerability Analysis
The vulnerability resides in the plugin's administrative AJAX endpoint responsible for bootstrapping the ProfileGrid parent plugin. The pg_install_profilegrid() function is registered through wp_ajax_pg_install_profilegrid, which makes it callable by any authenticated WordPress user. The handler does not verify the requesting user's capabilities and does not validate a WordPress nonce before executing plugin installation logic. As a result, a Subscriber can trigger installation and activation of the ProfileGrid plugin from the WordPress.org repository against the site. The vulnerable code paths are documented in the WordPress ProfileGrid admin class and the ProfileGrid WooCommerce class.
Root Cause
The root cause is a combination of two missing controls in the AJAX handler. First, there is no current_user_can() capability check restricting execution to administrators with install_plugins privileges. Second, there is no check_ajax_referer() or equivalent nonce validation, which permits cross-context invocation by any logged-in session.
Attack Vector
An attacker registers or authenticates as a Subscriber-level user on a vulnerable WordPress site. The attacker then issues a POST request to /wp-admin/admin-ajax.php with the action parameter set to pg_install_profilegrid. The handler fetches the ProfileGrid plugin from WordPress.org, writes files to the plugin directory, and activates it. Technical details are described in the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-11359
Indicators of Compromise
- Unexpected presence of the profilegrid-user-profiles-and-woocommerce-memberships (ProfileGrid) plugin directory when it was not deliberately installed by an administrator.
- WordPress activated_plugin entries in the audit log initiated by non-administrator user accounts.
- POST requests to /wp-admin/admin-ajax.php with action=pg_install_profilegrid originating from Subscriber-level sessions.
Detection Strategies
- Monitor web server access logs for requests to admin-ajax.php containing the pg_install_profilegrid action parameter.
- Alert on filesystem changes within wp-content/plugins/ that occur outside administrator-initiated maintenance windows.
- Correlate WordPress user role data with plugin activation events surfaced by activate_plugin hooks.
Monitoring Recommendations
- Enable a WordPress activity/audit logging solution to record plugin installations and the associated user account.
- Ingest web server and WordPress audit logs into a centralized data lake for cross-source correlation.
- Track new plugin directories appearing under wp-content/plugins/ via file integrity monitoring.
How to Mitigate CVE-2026-11359
Immediate Actions Required
- Update the Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin to a version later than 3.4.
- Audit the plugins directory and remove any unauthorized ProfileGrid installation performed via the vulnerable endpoint.
- Review Subscriber-level accounts for unfamiliar registrations and enforce strong registration controls.
Patch Information
The vendor addressed the vulnerability in a subsequent release. See the WordPress ProfileGrid changeset update for the applied fix, which adds capability and nonce checks to the AJAX handler.
Workarounds
- Disable open user registration on the WordPress site if it is not required for business operations.
- Deactivate the plugin until it can be updated to a patched version.
- Deploy a web application firewall rule to block requests to admin-ajax.php where action=pg_install_profilegrid originates from non-administrator sessions.
# Example WordPress CLI commands to inventory and remove unauthorized plugin activation
wp plugin list --status=active --format=table
wp plugin deactivate profilegrid-user-profiles-and-woocommerce-memberships
wp plugin delete profilegrid-user-profiles-and-woocommerce-memberships
wp plugin update ecommerce-user-profiles-by-profilegrid
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
