CVE-2026-88927: medium-severity vulnerability in rtMedia for WordPress, BuddyPress and bbPress
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.2%
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · rtMedia for WordPress, BuddyPress and bbPresspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/d60b3465-1e12-4738-b3dd-d45608eac78d/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — rtMedia for WordPress, BuddyPress and bbPress
In the same product, most dangerous first.
CVE-2023-5939—rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCEEPSS 1.3%CVE-2023-5931—rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCEEPSS 0.8%CVE-2026-88912MEDIUMrtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOREPSS 0.2%