The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin contains a missing capability check (CWE-862) and lacks nonce validation on its pg_install_profilegrid() AJAX handler. This flaw enables an authenticated user with Subscriber level or higher access to install and activate the ProfileGrid plugin without proper authorization. While it does not grant direct code execution, it permits the attacker to add third‑party code to the site, creating a potential vector for further compromise if the installed plugin is malicious or has additional vulnerabilities.

WordPress sites running the Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin at version 3.4 or earlier, typically those that use WooCommerce to manage memberships and user profiles. The issue is exploitable on any active installation where the AJAX endpoint is reachable and the user is authenticated with at least a Subscriber role.

The CVSS score of 4.3 classifies the issue as medium severity, and the EPSS score of less than 1% indicates a low likelihood of known exploitation. It is not listed in the CISA KEV catalog. An attacker can submit a crafted request to /wp-admin/admin-ajax.php with action=pg_install_profilegrid, bypassing the missing authorization and nonce checks, and trigger the unauthorized installation of the ProfileGrid plugin, potentially introducing arbitrary code or additional access.