Privilege Escalation Vulnerability in Groups Memberships and Access Control Plugin for WordPress

CVE-2026-77203

What is CVE-2026-77203?

The Groups Memberships and Access Control plugin for WordPress contains a vulnerability that allows authenticated users, with Subscriber-level access and above, to escalate their privileges to Administrator. This occurs due to a flawed check in the groups_join() function, which mistakenly derives group-join eligibility from the post's author capabilities instead of the authenticated user's capabilities. By exploiting this vulnerability, attackers can enroll themselves in any group, including those with the groups_admin_groups capability, effectively gaining elevated privileges. Exploitation necessitates providing an Administrator-authored post ID, enabling attackers to manipulate the context for an unauthorized authorization check.

References