Threats tagged 'ghsa-jcx9-wjx2-ccx2'

The Groups plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 6.7.0. This flaw exists in the group_join function via the 'group_id' parameter, which lacks proper validation. Authenticated users with Subscriber-level access or higher can exploit this to register for groups they are not authorized to join.