CVE-2026-88912 Overview
CVE-2026-88912 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the rtMedia plugin for WordPress, BuddyPress, and bbPress. Versions before 4.7.12 fail to verify ownership when a user changes the privacy level of an activity and its attached media. The plugin relies solely on a nonce that is shared with every logged-in user. Any authenticated user with subscriber-level access or higher can modify the privacy state of activities belonging to other users, either exposing private content or hiding public content.
Critical Impact
Authenticated attackers with low privileges can alter the privacy of any user's activity and attached media, resulting in unauthorized disclosure or concealment of user content.
Affected Products
- rtMedia for WordPress, BuddyPress and bbPress plugin versions prior to 4.7.12
- WordPress installations with the rtMedia plugin enabled
- BuddyPress and bbPress community sites integrating rtMedia
Discovery Timeline
- 2026-09-13 - CVE-2026-88912 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-88912
Vulnerability Analysis
The rtMedia plugin exposes an endpoint that changes the privacy level of an activity and its attached media items. The handler validates the request using a WordPress nonce but does not verify that the requesting user owns the target activity. Because WordPress issues the relevant nonce to every logged-in user, any subscriber-level account can generate a valid token and submit privacy-change requests referencing arbitrary activity identifiers. The attack requires authentication and some conditions on the target account, which is reflected in the attack complexity.
Root Cause
The root cause is missing authorization enforcement in the privacy-update handler. The code performs a nonce check for CSRF protection but omits an ownership check comparing the current user ID to the activity author ID. This is a classic authorization flaw categorized under [CWE-639] Authorization Bypass Through User-Controlled Key. Nonces protect against cross-site request forgery, not against horizontal privilege escalation between authenticated users.
Attack Vector
An attacker registers or uses an existing subscriber account on the target site. The attacker retrieves a valid nonce from any authenticated page and issues an HTTP request to the privacy-change endpoint, supplying the activity identifier of a victim user. The server processes the request without confirming ownership and toggles the activity between private and public. The attacker can enumerate activity IDs to reveal private posts or hide public content across the community.
See the WPScan Vulnerability Report for technical details on the vulnerable endpoint.
Detection Methods for CVE-2026-88912
Indicators of Compromise
- Unexpected privacy state transitions on BuddyPress activity items in the wp_bp_activity table or related meta.
- Access log entries showing repeated POST requests to rtMedia AJAX actions from subscriber-level accounts.
- User reports of previously private activities appearing publicly, or public activities becoming hidden.
Detection Strategies
- Audit HTTP request logs for authenticated POST requests to admin-ajax.php invoking rtMedia privacy actions with activity IDs not owned by the requesting user.
- Correlate the WordPress user session ID with the author ID of the activity referenced in each privacy-change request.
- Enable verbose logging in rtMedia and BuddyPress to record privacy changes with timestamps and the initiating user ID.
Monitoring Recommendations
- Monitor the plugin version across all WordPress sites and alert when rtmedia reports a version below 4.7.12.
- Track newly registered subscriber accounts followed by rapid activity-privacy API calls.
- Review database changes to BuddyPress activity privacy metadata on a scheduled basis.
How to Mitigate CVE-2026-88912
Immediate Actions Required
- Update the rtMedia plugin to version 4.7.12 or later on all affected WordPress installations.
- Review recent activity privacy changes and restore any incorrectly modified states from backups.
- Restrict new user registration or require moderation for subscriber accounts until patching is complete.
Patch Information
The vendor addressed the vulnerability in rtMedia version 4.7.12 by adding an ownership check before applying privacy changes. Administrators should install the update through the WordPress plugin dashboard or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily disable the rtMedia plugin if immediate patching is not feasible.
- Block access to rtMedia privacy AJAX endpoints at the web application firewall level for non-administrator users.
- Disable open user registration and audit existing subscriber-level accounts for unexpected activity.
# Update rtMedia via WP-CLI
wp plugin update buddypress-media --version=4.7.12
wp plugin list --name=buddypress-media --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
