{"schema":"threatline.record/2","record":{"id":"CVE-2026-77203","aliases":[],"summary":"Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode","details":"The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enroll themselves into any group including privileged groups carrying the groups_admin_groups capability, and to subsequently create and join a group containing every registered WordPress capability, effectively escalating their privileges to Administrator. Exploitation requires the attacker to supply an Administrator-authored post ID via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode handler in order to establish the privileged ambient post context used by the flawed authorization check.","categories":["Unclassified"],"product":"Groups – Memberships and Access Control","vendor":"itthinx","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77203","source_modified_at":"2026-09-26T22:51:17.071Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Groups – Memberships and Access Control","vendor":"itthinx","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.6.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00327,"percentile":0.24521,"score_date":"2026-10-23"},"published_at":"2026-09-26T17:28:59.609Z","modified_at":"2026-09-26T22:51:17.071Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77203","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-26T22:51:17.071Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77203","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e86dddc9-c1d3-426b-8ec7-2e56dc3c2379?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L586"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L624"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L463"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/wp/class-groups-wordpress.php#L248"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/groups/tags/4.5.0/lib/views/class-groups-shortcodes.php#L521"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3693123/groups"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-26T22:44:23.567859Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-26T22:51:17.071Z","content_hash":"f0b36577f25d351fad3c1e5ff7eae8235ccc3011a5501ffd8255577a722a530e"}}