The BuddyPress Groupblog plugin for WordPress allows an authenticated user with Subscriber or higher access to manipulate group blog settings through the parameters groupblog-blogid, default-member, and groupblog-silent-add. Because these parameters are accepted without proper authorization checks, a group admin can associate their group with any blog on the Multisite network, including the main site, and assign any WordPress role—including administrator—to new members. When the silent add feature is used, any user joining the group is automatically added to the targeted blog with the injected role, thus enabling a single authenticated attacker to elevate themselves or another user to Administrator on the main site. This flaw is a clear privilege escalation vulnerability affecting confidentiality, integrity, and availability of the entire network.

All installations of the BuddyPress Groupblog plugin up to and including version 1.9.3 are affected. The flaw surfaces on WordPress Multisite networks where groups can be created by users with Subscriber or higher abilities. Any site using this plugin and allowing group creation is vulnerable.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack requires an authenticated account with the ability to create or manage a group; it can be carried out via normal plugin administration interfaces, making it relatively straightforward for a determined attacker who owns a Subscriber account or higher to exploit. Once exploited, the attacker can grant themselves or any target user full Administrator rights on the main site of the network.