CVE-2026-77203: Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groupsjoin() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->postauthor rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groupsadmingroups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the postID parameter of the authenticated wpajaxparsemediashortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker must be able to use the authenticated wp_ajax_parse_media_shortcode handler.
What does an attacker need to provide to exploit it?
The attacker must supply an Administrator-authored post ID in the post_ID parameter. This causes the vulnerable authorization check to evaluate the ambient post author's capabilities instead of the attacker's own capabilities.
What access can exploitation provide?
An attacker can enroll themselves in privileged groups, including groups with the groups_admin_groups capability. They can then create and join a group containing every registered WordPress capability, escalating to Administrator.
Are installations affected by default?
The issue affects all plugin versions through 4.6.0. Exploitation additionally depends on an authenticated attacker being able to reference an Administrator-authored post ID through the specified AJAX handler.