CVE-2026-77203 is a privilege escalation vulnerability in the itthinx Groups – Memberships and Access Control WordPress plugin affecting all versions up to and including 4.6.0. The groups_join() function incorrectly bases group-join eligibility on the capabilities of the ambient post's author (via global $post->post_author) instead of the authenticated user's own capabilities. Additionally, the function generates and returns a valid groups-join-data hash and WordPress nonce in the same response, removing authorization barriers to self-enrollment. An attacker with Subscriber-level access or higher can exploit this by supplying an Administrator-authored post ID to the wp_ajax_parse_media_shortcode handler, thereby gaining membership in privileged groups and ultimately escalating to Administrator privileges.

An authenticated attacker with at least Subscriber-level access can escalate their privileges to Administrator by enrolling themselves into privileged groups. This compromises the integrity, confidentiality, and availability of the WordPress site by granting the attacker full administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin or disable it if possible to prevent exploitation.