Subscriber-to-Administrator escalation via ambient post authorization

Privilege escalation in Itthinx Groups 4.6.0 and earlier allows remote authenticated users to gain Administrator privileges. groups_join() checks the ambient post author's capabilities instead of the caller's, then returns a valid join hash and nonce to that caller. A Subscriber must submit an Administrator-authored post ID through the authenticated media-shortcode handler; successful enrollment grants privileged group capabilities.