Privilege Escalation in Groups - Memberships and Access Control Plugin

The 'Groups - Memberships and Access Control' plugin for WordPress (versions 4.6.0 and earlier) contains a critical privilege escalation vulnerability identified as CVE-2026-77203. The vulnerability originates in the groups_join() function, which incorrectly derives authorization from the post author's capabilities rather than the current user's session. By leveraging the wp_ajax_parse_media_shortcode AJAX handler and supplying an administrator-authored post ID, an authenticated user (with subscriber-level access or higher) can trigger the flawed authorization check. This allows the attacker to mint a valid groups-join-data hash and nonce, enabling self-enrollment into arbitrary groups. Successful exploitation permits an attacker to join privileged groups carrying the groups_admin_groups capability, ultimately allowing them to assign themselves all WordPress capabilities and gain full administrative control over the site.

Attack Chain

1. Attacker authenticates as a standard user with at least Subscriber-level privileges on the WordPress instance.
2. Attacker identifies a target post ID authored by a site Administrator to serve as the required context.
3. Attacker crafts an HTTP POST request to the wp_ajax_parse_media_shortcode AJAX handler.
4. Attacker includes the post_ID parameter set to the identified Administrator-authored post ID.
5. The plugin invokes the groups_join() function, which erroneously validates the request against the author of the provided post ID rather than the current user.
6. The application generates and returns a valid groups-join-data hash and WordPress nonce to the attacker.
7. Attacker uses the generated credentials to finalize self-enrollment into a high-privilege group.
8. Attacker gains full administrative capabilities, completing the privilege escalation.

Impact

Successful exploitation of CVE-2026-77203 allows unauthorized users to bypass access controls and gain administrative control of affected WordPress sites. This can lead to total site compromise, including the ability to exfiltrate user data, modify site content, install backdoors, and execute arbitrary code on the underlying server. Given the widespread use of WordPress plugins, this vulnerability presents a significant risk to any organization running vulnerable versions of the 'Groups' plugin.

Recommendation

Prioritized actions for detection and remediation:

• Update the 'Groups - Memberships and Access Control' plugin to a version patched against CVE-2026-77203 (immediately, upon vendor release).
• Review web server access logs for anomalous POST requests to wp-admin/admin-ajax.php involving the parse_media_shortcode action.
• Audit existing user groups and administrative role assignments for unauthorized modifications performed by non-administrative accounts.
• Deploy web application firewall (WAF) rules to detect and block requests that exhibit abnormal parameters in AJAX handler calls related to the 'Groups' plugin.