ProfileGrid WooCommerce CVE-2026-11359

Exploitation requires a valid WordPress user account at Subscriber level or above - PR:N (unauthenticated) exploitation is not possible per the CVSS:3.1/PR:L vector. The target site must have the ProfileGrid WooCommerce Integration plugin installed and active (versions up to and including 3.4) for the wp_ajax_pg_install_profilegrid hook to be registered. The WordPress installation must have outbound internet access to reach the WordPress.org plugin repository for the installation to succeed; air-gapped or repo-blocked environments would prevent completion. The specific plugin installed is fixed (ProfileGrid from WordPress.org) - this flaw does not enable installation of arbitrary or malicious plugins. Exploitation is therefore most impactful on open-registration WooCommerce stores or sites with a large untrusted subscriber base.

The CVSS 3.1 base score of 4.3 (Medium) reflects a realistic assessment: network-accessible (AV:N), low complexity (AC:L), requiring low-privilege authentication (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). The score is proportionate - the attacker's capability is constrained to installing one specific plugin (ProfileGrid), not arbitrary code or arbitrary plugins, which limits the direct integrity impact. No EPSS score was provided in the intelligence data, but given the authenticated requirement, niche product footprint, and constrained impact, real-world exploitation probability is low. KEV status is negative and no POC code has surfaced, further reducing urgency. The primary risk scenario is on open-registration WooCommerce stores where untrusted users hold Subscriber accounts - an attacker could silently expand the site's plugin surface by adding ProfileGrid without admin consent, potentially as a precursor to chaining with vulnerabilities in that plugin. Defenders should weigh the low CVSS against the low exploitation barrier (any logged-in user) in high-user-count or open-registration deployments.

An attacker registers or obtains a Subscriber-level account on a WooCommerce store running the affected plugin. They send a crafted POST request to wp-admin/admin-ajax.php with action=pg_install_profilegrid while authenticated, bypassing both the missing capability check and missing nonce validation. The server installs and activates the ProfileGrid plugin from WordPress.org without any administrator interaction or approval.