Groups Memberships And Access Control
Monthly
Privilege escalation in the WordPress plugin Groups - Memberships and Access Control (itthinx) affects all versions up to and including 4.6.0, allowing any authenticated Subscriber-level user to self-enroll in arbitrary groups - including privileged admin groups - and ultimately mint a group that grants every registered WordPress capability, reaching Administrator. The root cause is an authorization check in groups_join() that reads the ambient post's author capabilities ($post->post_author) instead of the acting user's, while the same response hands the caller a valid join hash and nonce; an attacker only needs valid low-privilege credentials and the post ID of any Administrator-authored post, supplied via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode AJAX handler, with no victim interaction. Per available intelligence there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though our independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case, given the low bar of Subscriber self-registration on many sites.
Privilege escalation in the WordPress plugin Groups - Memberships and Access Control (itthinx) affects all versions up to and including 4.6.0, allowing any authenticated Subscriber-level user to self-enroll in arbitrary groups - including privileged admin groups - and ultimately mint a group that grants every registered WordPress capability, reaching Administrator. The root cause is an authorization check in groups_join() that reads the ambient post's author capabilities ($post->post_author) instead of the acting user's, while the same response hands the caller a valid join hash and nonce; an attacker only needs valid low-privilege credentials and the post ID of any Administrator-authored post, supplied via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode AJAX handler, with no victim interaction. Per available intelligence there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though our independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case, given the low bar of Subscriber self-registration on many sites.