CVE-2026-77203: WordPress Groups Plugin Privilege Escalation

CVE-2026-77203 Overview

CVE-2026-77203 is a privilege escalation vulnerability in the Groups – Memberships and Access Control plugin for WordPress, affecting all versions up to and including 4.6.0. The flaw resides in the groups_join() function, which evaluates group-join eligibility against the ambient post's author capabilities ($post->post_author) instead of the authenticated requester. In the same response, the plugin also mints a valid groups-join-data hash and WordPress nonce for the caller. Authenticated users with Subscriber-level access can enroll themselves into any group, including groups carrying the groups_admin_groups capability, and ultimately promote themselves to Administrator. The weakness is classified as CWE-269: Improper Privilege Management.

Critical Impact
Subscriber-level attackers can escalate to full Administrator privileges on affected WordPress sites, resulting in complete site compromise.

Affected Products

Groups – Memberships and Access Control plugin for WordPress
All versions up to and including 4.6.0
WordPress installations exposing the authenticated wp_ajax_parse_media_shortcode handler

Discovery Timeline

2026-09-26 - CVE-2026-77203 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-77203

Vulnerability Analysis

The vulnerability stems from a broken authorization model in the Groups plugin's shortcode handling path. The groups_join() function determines whether a request may join a given group by inspecting the capabilities of the ambient post's author rather than the capabilities of the currently authenticated session. When the ambient post is authored by an Administrator, every subsequent capability check inherits that elevated context.

Compounding the flaw, the same response path mints a valid groups-join-data hash and WordPress nonce for the caller. These tokens, intended as integrity controls, are instead issued to the attacker, removing the final barrier to self-enrollment. The result is unrestricted self-service group membership from any authenticated account.

Root Cause

The root cause is improper privilege management [CWE-269]. The plugin trusts $post->post_author as a proxy for the acting user's permissions. Authorization decisions must be bound to the authenticated principal, not to post ownership metadata attached to the request context.

Attack Vector

Exploitation requires an authenticated Subscriber or higher account. The attacker supplies an Administrator-authored post_ID to the wp_ajax_parse_media_shortcode handler, establishing a privileged ambient post context. The flawed authorization check then permits joining any group, including one granting groups_admin_groups. The attacker subsequently creates and joins a group carrying every registered WordPress capability, effectively becoming an Administrator. Technical details and vulnerable call sites are documented in the Wordfence Vulnerability Analysis and the WordPress Groups Shortcodes Code.

Detection Methods for CVE-2026-77203

Indicators of Compromise

Unexpected wp_ajax_parse_media_shortcode AJAX requests originating from low-privilege accounts that reference Administrator-authored post_ID values.
New or modified entries in the groups_group and groups_user_group database tables assigning privileged capabilities to Subscriber-level users.
Unexplained accounts gaining the groups_admin_groups capability or being promoted to Administrator role.
Creation of new groups containing an unusually broad set of WordPress capabilities.

Detection Strategies

Review WordPress audit logs for admin-ajax.php calls with action=parse-media-shortcode from non-editor accounts.
Correlate role or capability changes with recent AJAX activity from the same user session.
Baseline the membership of groups carrying administrative capabilities and alert on unexpected additions.

Monitoring Recommendations

Enable verbose logging on the Groups plugin and ingest WordPress logs into a centralized SIEM for correlation.
Monitor web server access logs for POST requests to admin-ajax.php containing parse-media-shortcode from low-privilege sessions.
Alert on any WordPress user whose role transitions upward outside of a documented administrative change window.

How to Mitigate CVE-2026-77203

Immediate Actions Required

Update the Groups – Memberships and Access Control plugin to a version newer than 4.6.0 that includes the fix in changeset 3693123.
Audit all WordPress accounts for unauthorized role changes or additions to privileged groups, and revoke anomalous grants.
Rotate credentials and application passwords for any account showing suspicious AJAX activity.
Review installed plugins, themes, and scheduled tasks for backdoors added during a potential compromise window.

Patch Information

The vendor addressed the authorization logic in the Groups plugin via changeset 3693123. Site operators should upgrade to the patched release immediately. Additional context is available in the Wordfence Vulnerability Analysis.

Workarounds

If patching cannot be performed immediately, deactivate the Groups plugin until an upgrade is applied.
Restrict user self-registration and set the default new user role to a non-privileged value in WordPress general settings.
Deploy a web application firewall rule to block authenticated parse-media-shortcode AJAX calls that reference post_ID values authored by Administrators.

bash

# Example WP-CLI commands to inventory and remediate exposure
wp plugin get groups --field=version
wp plugin update groups
wp user list --role=administrator --format=table
wp option get default_role
wp option update users_can_register 0