CVE-2026-11359 is a missing authorization vulnerability (CWE-862) in the Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress. The issue exists in versions up to and including 3.4 due to the lack of capability checks and nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. This allows authenticated attackers with Subscriber-level privileges or higher to install and activate the ProfileGrid plugin from WordPress without proper authorization.

An attacker with low-level authenticated access (Subscriber or above) can install and activate a plugin (ProfileGrid) without proper authorization. This could lead to unauthorized changes in the WordPress environment, potentially enabling further privilege escalation or malicious activity. The CVSS score of 4.3 reflects a medium severity impact with no direct confidentiality or availability impact but with integrity impact due to unauthorized plugin activation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for unauthorized plugin installations. Implement manual checks or custom code to enforce capability and nonce validation on the affected AJAX handler if possible.