What’s Vulnerable › Vulnerabilities
CVE-2026-88912: rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR
- Severity: medium (CVSS 4.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-13 · updated 2026-09-14
- Weakness: CWE-639
Description
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
Affected products
- rtMedia for WordPress, BuddyPress and bbPress: before 4.7.12 — fixed in 4.7.12
How to fix
Upgrade to a fixed version: rtMedia for WordPress, BuddyPress and bbPress 4.7.12. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-88912 or the next vulnerability affects your stack