Executive brief
rtMedia is a popular WordPress plugin that adds media management and privacy controls to BuddyPress and bbPress communities. The plugin fails to verify that a user owns an activity before allowing them to change its privacy level, letting any subscriber-level account make other users' private posts public or hide them. This exposes sensitive user content and disrupts community privacy expectations.
Technical details
The vulnerability is an insecure direct object reference (IDOR) in the activity privacy modification endpoint. The plugin relies only on a nonce value that is shared with all logged-in users to authorize privacy changes, without verifying ownership of the target activity. An attacker with a subscriber account can enumerate sequential activity IDs and send a POST request to the admin-ajax.php endpoint (rtm_change_activity_privacy action) to change any activity's privacy level to public (privacy=0) or hidden (privacy=80). The vulnerability requires BuddyPress to be active, the Privacy feature enabled, and users allowed to override privacy settings. Fixed in version 4.7.12.
Affected products
- rtMedia rtMedia for WordPress, BuddyPress and bbPress before 4.7.12
Timeline
- 2026-09-11: disclosed
- 2026-09-12: patched: Fixed in version 4.7.12