CVE-2026-77203 in Groups – Memberships and Access Control Plugin
Summary
by MITRE • 09/26/2026
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within the Groups – Memberships and Access Control plugin for WordPress, affecting versions up to 4.6.0, represents a critical privilege escalation flaw rooted in improper access control mechanisms. This issue is classified under CWE-269, which denotes Improper Privilege Management, as it allows an attacker to bypass intended restrictions on user roles. The core technical defect lies within the groups_join() function, which is responsible for processing requests related to group membership. Instead of validating whether the currently authenticated user possesses the necessary permissions to join a specific group based on their own assigned capabilities, the code erroneously derives eligibility from the ambient post context. Specifically, it inspects the global $post object and checks the post_author field to determine if the author has sufficient privileges. This architectural decision creates a significant security gap because it decouples the authorization check from the actual actor making the request.
The operational impact of this flaw is severe, enabling authenticated attackers with even minimal Subscriber-level access to escalate their privileges to that of an Administrator. By exploiting this logic error, an attacker can enroll themselves into any group, including those designated as privileged groups that carry the groups_admin_groups capability. Once inside such a group, the attacker gains the ability to create and join new groups configured with every registered WordPress capability. This effectively grants them full administrative control over the WordPress installation. The exploitation process requires the attacker to interact with the wp_ajax_parse_media_shortcode handler while supplying an Administrator-authored post ID via the post_ID parameter. This action establishes a privileged ambient post context, tricking the flawed authorization check into believing that the request originates from or is authorized by an administrator due to the post author's status rather than the requester's actual identity.
Furthermore, the vulnerability is compounded by the fact that the function simultaneously mints and returns valid groups-join-data hashes and WordPress nonces for the caller in the same response. This mechanism eliminates any remaining authorization barriers to self-enrollment, as the system validates these tokens without re-verifying the user's permissions against their actual role. From a threat intelligence perspective, this behavior aligns with MITRE ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials and then escalate privileges through misconfigured access controls. The exploitation path is relatively straightforward for any authenticated user who can identify or create posts authored by administrators, making it a high-risk vulnerability in environments where multiple users have posting capabilities.
Mitigation strategies must prioritize immediate updates to the latest version of the Groups plugin, which addresses this authorization logic error. In instances where updating is not immediately feasible, administrators should restrict media shortcode parsing permissions to only those roles that absolutely require them, thereby limiting the attack surface for the wp_ajax_parse_media_shortcode handler. Additionally, implementing strict input validation and ensuring that all privilege checks rely on the current user's capabilities rather than ambient context variables can prevent similar logic flaws in custom code or other plugins. Regular security audits focusing on access control implementations are essential to detect such discrepancies before they can be exploited by malicious actors seeking administrative access.