The vulnerability resides in the groups_join() function of the Groups – Memberships and Access Control plugin. It incorrectly bases join eligibility on the author of the post referenced by the $post object rather than on the authenticated user. For an authenticated user with at least Subscriber privileges, the flaw bypasses all permission checks, allowing the user to add themselves to any group, including privileged ones that grant the groups_admin_groups capability. By creating and joining a group that includes every WordPress capability, the attacker can effectively elevate their privileges to Administrator.

WordPress sites installing the Groups – Memberships and Access Control plugin created by itthinx. Versions up to and including 4.6.0 are affected. The issue applies to all installations that enable the groups_join shortcode and expose the wp_ajax_parse_media_shortcode endpoint. Administrators and plugin developers should verify whether the plugin is present and its version; any use of the plugin before 4.6.1 carries the risk.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker has access to an Administrator‑authored post ID, which the attacker can supply through the post_ID parameter of the wp_ajax_parse_media_shortcode handler. Because the vulnerable checks rely on the ambient post context and the attacker can control it, the attack vector is likely an authenticated Ajax request originating from a user’s browser or through an authenticated REST call, making the vulnerability exploitable when an authenticated user with Subscriber-level access can influence the request. The lack of public exploitation records or KEV listing suggests a moderate to high exploitation probability limited to sites with the plugin enabled and lacking additional access controls.