CVE-2026-88927: rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR

Q: Who can exploit this issue?

Any authenticated user with a subscriber-level account or a higher-privileged account can exploit it. The affected plugin does not verify that the uploader owns or has permission to write to the target album.

Q: What is the practical impact for private albums?

An attacker can place media into another user's private album, and the media is attributed to that album owner. This permits unauthorized content injection into albums the attacker should not be able to modify.

Q: Which installations are affected?

Installations using rtMedia for WordPress, BuddyPress and bbPress versions earlier than 4.7.14 are affected. The issue requires the plugin's album media-upload functionality and an authenticated subscriber-or-higher account.

Published Oct 14, 2026

Updated

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.

Affected Software

1 affected component

rtMedia rtMedia for WordPress, BuddyPress and bbPress<4.7.14

Event History

Oct 14, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with a subscriber-level account or a higher-privileged account can exploit it. The affected plugin does not verify that the uploader owns or has permission to write to the target album.

What is the practical impact for private albums?

An attacker can place media into another user's private album, and the media is attributed to that album owner. This permits unauthorized content injection into albums the attacker should not be able to modify.

Which installations are affected?

Installations using rtMedia for WordPress, BuddyPress and bbPress versions earlier than 4.7.14 are affected. The issue requires the plugin's album media-upload functionality and an authenticated subscriber-or-higher account.