CVE-2026-77203
Received Received - Intake

Privilege Escalation in Groups WordPress Plugin

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: Wordfence

Description
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-77203
EUVD
EUVD-2026-87787

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itthinx groups to 4.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator. The flaw exists in the groups_join() function which incorrectly checks the post author's capabilities instead of the current user's capabilities. Attackers can exploit this by supplying an Administrator-authored post ID to enroll themselves into privileged groups, including one containing all WordPress capabilities.

Detection Guidance

Check for unauthorized group enrollments or privilege changes in WordPress admin logs. Look for wp_ajax_parse_media_shortcode requests with post_ID parameters referencing admin-authored posts. Review Groups plugin activity for suspicious self-enrollments into privileged groups.

Impact Analysis

If you use this plugin, attackers could gain full control of your WordPress site. They can create new admin accounts, modify site content, install malicious plugins, or steal sensitive data. The vulnerability requires only basic user access to exploit, making it particularly dangerous for sites with untrusted users.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements. GDPR requires protecting personal data, while HIPAA mandates securing health information. A successful exploit could result in unauthorized data exposure, leading to regulatory fines and legal consequences for non-compliance.

Mitigation Strategies

Update the Groups plugin to the latest version beyond 4.6.0 immediately. Temporarily restrict Subscriber-level access to sensitive functions. Monitor for unauthorized privilege escalations and block suspicious wp_ajax_parse_media_shortcode requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart