Vulnerability in Groups – Memberships and Access Control — CVE-2026-77203

HighSeverity
CVSS 8.8

—Estimated exploit probability
EPSS

10,000+ sitesInstalls

4.7.0Fixed in

What to do now

Update Groups – Memberships and Access Control to 4.7.0 or later.

Affected versions

Everything up to and including 4.6.0

Affected: Groups – Memberships and Access Control (plugin, groups)

Check: The plugin on wordpress.org / Our record for Groups – Memberships and Access Control

The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.

This description is reproduced verbatim from the public vulnerability record.

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

Vulnerability in Groups – Memberships and Access Control — CVE-2026-77203

What to do now

What the vulnerability is

Sources