CVE-2026-88912: rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR

Q: What level of access does an attacker need?

The attacker needs a logged-in account with subscriber-level access or higher. Exploitation relies on a nonce that is shared with every logged-in user rather than proof that the attacker owns the targeted activity.

Q: What can an attacker change on another user's content?

An attacker can change the privacy setting of another user's activity and any media attached to it. This can make private activity public or hide it.

Published Sep 13, 2026

Updated

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

Affected Software

1 affected component

rtMedia for WordPress, BuddyPress and bbPress<4.7.12

Event History

Sep 13, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker needs a logged-in account with subscriber-level access or higher. Exploitation relies on a nonce that is shared with every logged-in user rather than proof that the attacker owns the targeted activity.

What can an attacker change on another user's content?

An attacker can change the privacy setting of another user's activity and any media attached to it. This can make private activity public or hide it.