PT-2025-45542 · WordPress · Plugin Groups

Angus Girvan · Published 2025-11-08 · Updated 2025-11-11 · CVE-2025-11748

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Groups plugin for WordPress versions prior to 6.7.1

Description The Groups plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This flaw stems from inadequate validation of a user-controlled key, specifically the group id parameter within the group join function. Authenticated attackers possessing Subscriber-level access or higher can exploit this to join groups beyond those designated in the shortcode. The vulnerable parameter is group id.

Recommendations Update the Groups plugin to version 6.7.1 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-11748

Affected Products

Plugin Groups

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11748 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387846%40groups&new=3387846%40groups&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/142422 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d0f6d28a-d5ca-4700-bc61-f2dd20f06fcf?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1987117959769145485 · Twitter Post
• https://twitter.com/CVEnew/status/1987011683038945332 · Twitter Post
• https://t.me/CVEtracker/36852 · Telegram Post
• https://t.me/cveNotify/142196 · Telegram Post
• https://plugins.trac.wordpress.org/browser/groups/trunk/lib/views/class-groups-shortcodes.php · Note