CVE-2026-77203 - Groups = 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
Brief
CVE ID : CVE-2026-77203
Published : Sept. 26, 2026, 6:16 p. m.
- 44 minutes ago
Description : The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.
- 0.
This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post-post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment.