EUVD-2026-42541
GHSA-3m2g-qgvr-j86q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible AJAX endpoint (AV:N), no complexity (AC:L), Subscriber auth required (PR:L), constrained to installing one specific plugin (I:L), no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Memberships and User Profiles for WooCommerce - ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ProfileGrid plugin from wordpress.
AnalysisAI
Unauthorized plugin installation affects the Memberships and User Profiles for WooCommerce - ProfileGrid WooCommerce Integration plugin (versions up to and including 3.4), allowing any authenticated WordPress user at Subscriber level or above to force-install and activate the ProfileGrid plugin without administrative approval. The flaw stems from a dual failure - absent capability check and absent nonce validation - on the pg_install_profilegrid() AJAX handler, registered via the wp_ajax_pg_install_profilegrid hook. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the low barrier to exploitation (any authenticated user) makes this a meaningful integrity risk on multi-tenant or open-registration WooCommerce stores.
Technical ContextAI
The vulnerability resides in the WordPress plugin published by Metagauss (CPE: cpe:2.3:a:metagauss:memberships_and_user_profiles_for_woocommerce_-_profilegrid_woocommerce_integration:*:*:*:*:*:*:*:*) and classified under CWE-862 (Missing Authorization). WordPress AJAX handlers registered with wp_ajax_* are accessible to any logged-in user unless the handler explicitly verifies the requester's capability (e.g., current_user_can('manage_options')) and validates a nonce. The pg_install_profilegrid() handler in admin/class-profilegrid-woocommerce-admin.php (line 303 and 352) and includes/class-profilegrid-woocommerce.php (line 166) performs neither check. Because the WordPress Plugin API's plugins_api() and Plugin_Upgrader are invoked directly without authorization gates, the handler executes the installation and activation of the ProfileGrid plugin from the WordPress.org repository on behalf of any authenticated caller, regardless of their role.
RemediationAI
Administrators should update the ProfileGrid WooCommerce Integration plugin immediately via the WordPress dashboard or WP-CLI. A fix has been committed upstream at WordPress Plugin SVN changeset 3592677; however, the exact released version number containing this fix has not been independently confirmed from the available data - verify the installed version against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4cce2842-bd8e-4a83-b83c-66aefe4df4b8 after updating. As a compensating control where immediate patching is not possible, restrict new WordPress user registrations to prevent untrusted Subscriber accounts from being created, noting that existing Subscriber-level users will retain the ability to exploit this until patched. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php with action=pg_install_profilegrid from non-administrator sessions can block exploitation, though this may interfere with legitimate plugin functionality if the handler serves other purposes.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today