CVE-2026-11359

The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ProfileGrid plugin from wordpress.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ecommerce-user-profiles-by-profilegrid/tags/3.4/admin/class-profilegrid-woocommerce-admin.php#L303
• https://plugins.trac.wordpress.org/browser/ecommerce-user-profiles-by-profilegrid/tags/3.4/admin/class-profilegrid-woocommerce-admin.php#L352
• https://plugins.trac.wordpress.org/browser/ecommerce-user-profiles-by-profilegrid/tags/3.4/includes/class-profilegrid-woocommerce.php#L166
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3592677%40ecommerce-user-profiles-by-profilegrid&new=3592677%40ecommerce-user-profiles-by-profilegrid
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4cce2842-bd8e-4a83-b83c-66aefe4df4b8?source=cve

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113579Adobe Experience Manager is affected by an Improper Control …9.9
• CVE-2026-11358The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cook…4.4
• CVE-2026-113580Adobe Experience Manager is affected by an Improper Control …9.9
• CVE-2026-113582UNSUPPORTED WHEN ASSIGNED Improper restriction of XML extern…7.5
• CVE-2026-113583Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cros…6.1
• CVE-2026-113584The placester WordPress plugin through 1.4.3 does not perfor…9.8
• CVE-2026-113593An issue was discovered in Django 6.1 before 6.1.3, 6.0 befo…3.1
• CVE-2026-113594Sharkord before 0.0.8 contains a missing authorization vulne…5.4
• CVE-2026-113595Sharkord before 0.0.26 contains a missing authorization vuln…4.3
• CVE-2026-113596Webstudio before 0.256.0 contains a missing authorization vu…3.1
• CVE-2026-113597Blinko through 1.8.8 contains an insecure direct object refe…5.4
• CVE-2026-113598Modoboa before 2.8.0 contains an insecure direct object refe…4.3