The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
CVE-2026-88912
NONE
Updated Sep 13, 2026
WordPress
CVE Details
CVE ID
CVE-2026-88912
Published Date
Sep 13, 2026
Vendor
WordPress
Severity
NONE
Impact
Minimal impact
Source
View Advisory