EUVD-2026-76957
GHSA-fvcq-6v6m-mmrf
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
IDOR over sequential activity IDs needs no special conditions, so AC:L; PR:L reflects mandatory subscriber login; no availability or scope impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
AnalysisAI
Horizontal privilege escalation in rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.12 allows any authenticated subscriber-level user to alter the privacy settings of other users' activities and attached media. The plugin's privacy-change endpoint validates only a WordPress nonce that is shared across all logged-in users, performing no ownership verification against the requesting account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at minimum subscriber role on the target site - anonymous unauthenticated access is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:L/UI:N) is broadly reasonable but may understate practical exploitability - AC:H implies significant attack complexity, yet IDOR attacks against sequential WordPress activity IDs are trivially enumerable, suggesting AC:L is more accurate in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update rtMedia for WordPress, BuddyPress and bbPress to version 4.7.12 or later, which introduces ownership verification on the privacy-change endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unau
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables un
Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.9) permits low-privileged authen
Share
External POC / Exploit Code
Leaving vuln.today