CVE-2026-88927

rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.

Affected

rtMedia for WordPress, BuddyPress and bbPress

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 9th percentile

Published

2026-10-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d60b3465-1e12-4738-b3dd-d45608eac78d/

References

• CVE Record
• NVD entry