Medium severity · published Sep 13, 2026
CVE-2026-88912
rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
rtMedia for WordPress, BuddyPress and bbPress ·
before 4.7.12 · source: vendor
Affected product
RF
rtMedia for WordPress, BuddyPress and bbPress
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-88912
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-88912
wpscan.com
https://wpscan.com/vulnerability/58115528-18b6-4f2a-9f6c-d84fdcd6efb4/
More from rtMedia for WordPress, BuddyPress and bbPress
8.8
CVE-2023-5931
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE
7.2
CVE-2023-5939
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCE
4.3
CVE-2026-88927
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR