CVE-2026-11359

Name of the Vulnerable Software and Affected Versions Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration versions prior to 3.5

Description Authenticated users with Subscriber-level access and above can perform unauthorized installation and activation of the ProfileGrid plugin. This occurs because the pg install profilegrid() function, handled via the wp ajax pg install profilegrid AJAX endpoint, lacks proper capability checks and nonce validation. A nonce is a unique token used to protect against cross-site request forgery by verifying that the request was intentionally sent by the user.

Recommendations Update the plugin to a version later than 3.4.