4.3
Medium
CVE-2026-88927 The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may…
Description
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| rtMedia for WordPress, BuddyPress and bbPress 4.7 | earliest → < 4.7.14 | 4.7.14 |
Other CVEs of rtMedia for WordPress, BuddyPress and bbPress
The 4 CVEs of rtMedia for WordPress, BuddyPress and bbPress →
CVE-2026-88912
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before…
4.2
Medium
CVE-2023-5939
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file…
Not rated
CVE-2023-5931
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded,…
Not rated