CVE-2026-88927: Unknown Rtmedia For Wordpress, Buddypress And Bbpress

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.

Affected products

• Unknown Rtmedia For Wordpress, Buddypress And Bbpress: before 4.7.14 (fixed in 4.7.14)

Published 2026-10-14. Last modified 2026-10-14.