CVE-2026-11359 describes a missing authorization vulnerability (CWE-862) in the Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress. The vulnerability arises from the pg_install_profilegrid() AJAX handler, which lacks both capability checks and nonce validation. As a result, authenticated users with Subscriber-level privileges or higher can exploit this flaw to install and activate the ProfileGrid plugin without proper permissions. This affects all versions up to and including 3.4 of the plugin.

An attacker with authenticated access at the Subscriber level or above can install and activate the ProfileGrid plugin on the affected WordPress site. This unauthorized plugin installation could lead to further security risks depending on the installed plugin's behavior. The vulnerability does not directly impact confidentiality or availability but allows unauthorized modification of the WordPress environment, which may facilitate additional attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized plugin installations. Avoid granting Subscriber-level access to untrusted users. Follow updates from the vendor or plugin maintainers for a security patch addressing this issue.