CVE-2026-88912 | BDVDB-2026-372349 Detail

Description#

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-13Record published in the CVE List.