Unknown Rtmedia For Wordpress, Buddypress And Bbpress vulnerabilities

4 vulnerabilities

Known vulnerabilities in Unknown Rtmedia For Wordpress, Buddypress And Bbpress, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2026-88927unknownrtmedia for wordpress, buddypress and bbpress
EPSS score
0.20%
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.4.3CVE-2026-88912unknownrtmedia for wordpress, buddypress and bbpress+1
EPSS score
0.19%
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.7.2CVE-2023-5939rtcamprtmedia+2
EPSS score
1.33%
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.8.8CVE-2023-5931rtcamprtmedia+2
EPSS score
0.82%
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server