Description

The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-26T18:16:29.917Z",
  "pubdate": "2026-09-26T18:16:29.917Z",
  "executiveSummary": "The Groups – Memberships and Access Control plugin for WordPress, in versions up to and including 4.6.0, contains a critical privilege escalation vulnerability.\nThe flaw exists within the groups_join() function, which incorrectly utilizes the global $post->post_author context to determine membership eligibility rather than verifying the current user's actual permissions.\nThis vulnerability allows authenticated users with Subscriber-level access or higher to bypass authorization mechanisms and join any arbitrary group.\nBy joining privileged groups, such as those possessing the groups_admin_groups capability, attackers can grant themselves elevated WordPress roles, potentially achieving full administrative access.\nExploitation requires the attacker to manipulate the post_ID parameter within the wp_ajax_parse_media_shortcode handler to spoof an administrative context.\nThis vulnerability represents a severe security risk, as it permits unauthorized users to gain control over the WordPress site without prior elevated permissions.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure authorization check within the groups_join() function. Instead of validating the identity and permissions of the authenticated user attempting to join a group, the function relies on the ambient $post->post_author global variable.\nIn the WordPress environment, the global $post object can be influenced by the request context. By targeting the wp_ajax_parse_media_shortcode handler and passing a specific post_ID parameter, an attacker can force the application to treat the request as if it originated from the author of that post.\nIf the chosen post_ID belongs to an Administrator, the flawed logic in groups_join() interprets the attacker's request as being authorized by the Administrator's credentials.\nThe function then processes the request, minting and returning a valid groups-join-data hash and a WordPress nonce in the response. This effectively validates the fraudulent enrollment and bypasses all necessary security gates.\nThe attack flow is as follows: 1) The authenticated attacker (Subscriber or higher) identifies a post authored by an Administrator to use as a reference point. 2) The attacker invokes the wp_ajax_parse_media_shortcode handler, providing the identified post_ID in the payload. 3) The application context switches to the Administrator's authorship. 4) The groups_join() function incorrectly performs its authorization check against the Administrator's context. 5) The attacker is successfully added to the target privileged group. 6) Because the privileged group carries the groups_admin_groups capability, the attacker can then assign themselves administrative privileges.\nThis exploitation technique is highly effective because the plugin returns the cryptographic tokens (hashes and nonces) required to complete the group joining process, leaving no defensive barrier for the application to reject the unauthorized membership modification.\nThe impact is complete site compromise, as the escalation to Administrator role allows the attacker to execute arbitrary code, modify site content, and manipulate other user accounts, representing the highest possible severity for a WordPress site."
}