CVE-2026-88927 — rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR

CVE-2026-88927

rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR PUBLISHED

Description (CNA)

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.

Affected (CNA)

Vendor / product	Versions
Unknown / rtMedia for WordPress, BuddyPress and bbPress	affected 0 before 4.7.14

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/d60b3465-1e12-4738-b3dd-d45608eac78d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.