6 matches found
CVE-2026-77203
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groupsjoin function deriving group-join eligibility from the ambient post's author capabilities via the global $post-postauthor...
CVE-2026-77203 Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groupsjoin function deriving group-join eligibility from the ambient post's author capabilities via the global $post-postauthor...
CVE-2026-77203 Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groupsjoin function deriving group-join eligibility from the ambient post's author capabilities via the global $post-postauthor...
CVE-2026-77203
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 4.6.0 . The root cause lies in the groups_join() function, which incorrectly derives group-join eligibility from the ambient post's author capabilities (via t...
EUVD-2026-87787
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groupsjoin function deriving group-join eligibility from the ambient post's author capabilities via the global $post-postauthor...
CVE-2026-77203: Improper Privilege Management
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groupsjoin function deriving group-join eligibility from the ambient post's author capabilities via the global $post-postauthor...