Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation

I cannot provide a detailed exploitation research plan or specific actionable payloads for this vulnerability. I can, however, explain the security principles surrounding authorization in WordPress AJAX handlers and how developers can prevent similar vulnerabilities.

Understanding Missing Authorization in WordPress AJAX

The vulnerability described involves a "Missing Authorization" flaw in a specific WordPress AJAX handler. In WordPress, AJAX actions are registered using two main hooks:

1. wp_ajax_{action}: For authenticated users.
2. wp_ajax_nopriv_{action}: For unauthenticated users.

When a handler is registered via wp_ajax_{action}, it is accessible to any logged-in user, regardless of their role (e.g., a Subscriber, Contributor, or Administrator). If the function tied to this hook performs sensitive operations—such as installing plugins, modifying site settings, or accessing private data—it must include explicit security checks to ensure the current user has the necessary permissions.

Common Security Failures

Vulnerabilities typically arise from two missing components in the AJAX callback function:

1. Capability Checks: WordPress uses a Role-Based Access Control (RBAC) system. Functions should use current_user_can() to verify that the user possesses a specific capability (like install_plugins or manage_options) before proceeding. Without this, a low-privileged user (like a Subscriber) can trigger actions intended only for Administrators.
2. Nonce Validation: Nonces (numbers used once) protect against Cross-Site Request Forgery (CSRF). They ensure that the request was intentionally initiated by the user from within the site's interface. Functions should use check_ajax_referer() or wp_verify_nonce() to validate these tokens.

Secure Implementation Pattern

To secure an AJAX handler in a WordPress plugin, developers should follow this pattern:

public function secure_ajax_handler() {
    // 1. Verify the Nonce (Prevents CSRF)
    if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'my_plugin_action_string' ) ) {
        wp_send_json_error( 'Invalid security token.', 403 );
    }

    // 2. Check User Capability (Prevents Unauthorized Access)
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_send_json_error( 'You do not have permission to perform this action.', 403 );
    }

    // 3. Perform the Action
    // ... logic for the sensitive operation ...

    wp_send_json_success( 'Action completed successfully.' );
}

Remediation for CVE-2026-11359

For the specific vulnerability identified, the patch in version 3.4.1 likely introduced a current_user_can('manage_options') check and added nonce verification within the pg_install_profilegrid() function. Users of the "Memberships and User Profiles for WooCommerce" plugin should ensure they have updated to at least version 3.4.1 to mitigate this risk.

Security researchers investigating such issues typically use tools like WP-CLI to audit registered hooks (wp hook list wp_ajax) and verify the presence of these security checks in the corresponding callback functions.