CVE-2026-88912
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media. It relies only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
Risk Assessment
Low-privileged users can alter the privacy of others' content, leading to privacy breaches and potential data exposure. This may undermine trust in the social platform.
Recommendation
Update the rtMedia plugin to version 4.7.12 or later. Check whether any unauthorized privacy changes to activities have occurred.
Other vulnerabilities in rtMedia for WordPress, BuddyPress and bbPress
See all- CVE-2026-59551High
SQL Injection vulnerability with subscriber privileges in the rtMedia for WordPress, BuddyPress and bbPress plugin up to version 4.7.10. Allows a user with subscriber role to execute arbitrary SQL queries.
- CVE-2026-15287Medium
The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to time-based SQL injection via the order_by parameter in all versions up to and including 4.6.18 due to insufficient escaping and lack of proper SQL query preparation.
- CVE-2026-40773Medium
Versions of rtMedia for WordPress, BuddyPress, and bbPress up to 4.7.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Original NVD description (English source)
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS