CVE-2026-88912
Received Received - Intake

rtMedia for WordPress Privilege Escalation via Activity Privacy Change

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: WPScan

Description
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-88912
EUVD
EUVD-2026-76957

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rtmedia rtmedia to 4.7.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) issue in the rtMedia plugin for WordPress, BuddyPress, and bbPress. It allows attackers with subscriber-level access or higher to change another user's private activity to public or hide it without proper ownership verification. The flaw relies on a nonce shared with all logged-in users, bypassing access controls.

Detection Guidance

To detect this vulnerability, check the installed version of the rtMedia plugin in your WordPress site. If the version is below 4.7.12, the system is vulnerable. You can verify the version via the WordPress admin dashboard under Plugins or by inspecting the plugin files directly.

Impact Analysis

If you use the rtMedia plugin version prior to 4.7.12, an attacker with minimal access could alter your private content visibility. This could expose sensitive information publicly or hide important updates, leading to privacy breaches or miscommunication within your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized exposure of private user data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations may face compliance penalties if user data is improperly disclosed due to this flaw.

Mitigation Strategies

Immediately update the rtMedia plugin to version 4.7.12 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Ensure all user accounts follow the principle of least privilege to minimize potential impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88912. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart