CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification vulnerability

Subscriber+ Arbitrary Activity Privacy Modification vulnerability discovered by JunHee CHO in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.12...

EUVD-2026-76957

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress plugin (versions before 4.7.12 ) is vulnerable to an IDOR (Insecure Direct Object Reference) issue. The software fails to verify ownership when changing the privacy level of an activity and its associated media, relying instead on a nonce shared w...

PT-2026-90796

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...