The Groups plugin for WordPress contains an insecure direct object reference flaw that allows an attacker with Subscriber-level or higher access to use the group_join function and supply a group_id that was not intended for the visitor. The lack of validation on this user-controlled key means the attacker can register for any group, potentially bypassing the intended membership controls or privacy settings enforced by the shortcode. This flaw does not provide denial of service or privilege escalation beyond the user’s existing authenticated session, but it enables unwanted membership in groups that may contain sensitive information or associated access rights.

WordPress sites running the itthinx Groups plugin version 3.7.0 or earlier are affected. The vulnerability applies to all releases up to and including 3.7.0, regardless of the WordPress core version. Site administrators should verify which plugin version is installed and plan an update accordingly.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1 percent suggests a low probability of exploitation at this time. The vulnerability is not included in the CISA KEV catalog. The attacker must first authenticate to the site as a Subscriber or higher role, which limits the threat to legitimate users who have been granted access. Once logged in, the attacker can seamlessly join arbitrary groups by manipulating the group_id parameter, but no further system compromise or data exfiltration is possible with this flaw alone.