WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification vulnerability

Subscriber+ Arbitrary Activity Privacy Modification vulnerability discovered by JunHee CHO in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.12...

CVE-2026-88912 rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-88912 rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

Malicious code in ida-enting56-ruro (npm)

Source: amazon-inspector ada0d19cd5db50df02467e487e4df43c45c69ce76d6d86c3098a87b26bde48d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-gado-gado10-tititugel (npm)

Source: amazon-inspector 87df1eaf2853594c7141617e743a585751da10a7e605d821069a9dc7f3466173 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-empal98-breki (npm)

Source: amazon-inspector 5626d40ff26cfb78ae0ba7e348cf82c5a6315dcf31a029a706d544f3ef00a3cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-dradag80-sukiwir (npm)

Source: amazon-inspector e7cfb7cd6870bd9a9efb3f98e95a63061cc0a8458b98a81585760c15d1b6c5ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-botok37-breki (npm)

Source: amazon-inspector 17c52e16799dfe440e5fe8addce0e5437e30697367820d08af25d1e224613dd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-brongkos2-miaww (npm)

Source: amazon-inspector 7fdd631d594de9741bc0b0cfd7537e918d535f61eb4c0b67a57ae2d2113b8bb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-brongkos75-sluey (npm)

Source: amazon-inspector c89be3f058209a45605990dba1d51746a0bd0d5a1782c273bd976440658ccc14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-brengkes53-sumpek (npm)

Source: amazon-inspector f90157f63cf45c2c462c5ac81a8532b1e6df709cadfe42d7dcfb910f197ccb79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-brengkes50-breki (npm)

Source: amazon-inspector 9a7cf5ac1ee283058ce7ee90ccdbb4a19fcb3a66bada649e49e3d26de50b654f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-brengkes11-sluey (npm)

Source: amazon-inspector 087593db7275adfe5ac0ebddcc93e35fbd950cada48f1a67a19258b62735df47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-bakso49-crottsekebon (npm)

Source: amazon-inspector f1b873c60a6e825cc19ae0a5dd3f92b7525dbec1730c28f7aaa246caabc6d031 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in icy_ostrich_z3n (npm)

Source: amazon-inspector b6d74527347505c23f3c637047834b0901cd81f84d0b9dfb002b1872617b6b57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-bakwan25-breki (npm)

Source: amazon-inspector 54bca94faf502502ffac721775cccc28efce10af65a09f6b1700d3e7ef2e871d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-bakso58-ruro (npm)

Source: amazon-inspector 98c78c923d18f29de0dcedd3e01d8b8c046c340c0be8c8e247b263e92702efdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-asinan17-sluey (npm)

Source: amazon-inspector 1b8a733613a18c7fa8dd6e3c7b1c7525e1890904187fa98c9928db1962e0c563 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-asinan46-sluey (npm)

Source: amazon-inspector 874ddd3018c6a7c971bbf0feb07b788c6afff176899dc673ae32a3e8696ec3fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in icy_rhinoceros_z3n (npm)

Source: amazon-inspector 4a0865c3ffb80a67a475b8a70e3e7032e34e4dfec44929dcb5f75f7480799115 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...