CVE-2026-88912

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.12

Description The plugin fails to verify ownership when modifying the privacy level of an activity and its associated media. It relies solely on a nonce shared among all authenticated users, which enables users with subscriber-level permissions or higher to change the visibility of another user's private activity, either making it public or hiding it. This is an Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input without sufficient authorization checks.

Recommendations Update rtMedia for WordPress, BuddyPress and bbPress to version 4.7.12 or later.