Description

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-13T06:16:25.447Z",
  "pubdate": "2026-09-13T06:16:25.447Z",
  "executiveSummary": "The rtMedia plugin for WordPress, BuddyPress, and bbPress, in versions prior to 4.7.12, contains an authorization bypass vulnerability.\nThis flaw allows authenticated users, including those with subscriber-level privileges, to modify the privacy settings of arbitrary activity streams and associated media.\nThe vulnerability stems from an inadequate access control check where the plugin fails to verify user ownership of the requested resource before executing a privacy level modification.\nThe system relies on a generic, shared nonce accessible to all logged-in users rather than a cryptographically secure, user-specific authorization token.\nAn attacker can exploit this to force private content to become publicly visible or effectively hide legitimate activity, leading to unauthorized data exposure or denial of service regarding user content visibility.\nThe vulnerability is classified as an improper authorization flaw, posing a significant risk to user privacy and data integrity within the BuddyPress and WordPress ecosystem.\nExploitation requires active authentication on the target system; however, no administrative or high-level privileges are required.",
  "technicalDetails": "The vulnerability is rooted in a Broken Access Control mechanism within the rtMedia plugin's activity management functionality. Specifically, the component responsible for updating the privacy status of activity objects and linked media fails to enforce server-side ownership validation.\nUnder normal operating conditions, an application should verify that the current session user (UID) matches the owner ID of the activity object being modified. In this case, the codebase lacks the necessary conditional checks to compare the requestor's identity against the object's metadata.\nInstead of implementing a robust check, the plugin utilizes a nonce that is shared globally among all logged-in users. In the context of WordPress, a nonce should ideally be unique to the user, the action, and the specific object being modified to prevent Cross-Site Request Forgery (CSRF) and unauthorized access. By relying on a common nonce, the plugin treats requests from any authenticated subscriber as legitimate for any activity modification operation.\nThe attack flow proceeds as follows: First, an attacker identifies the target activity ID, which is typically exposed in the standard BuddyPress activity stream structure. Second, the attacker crafts a malicious request targeting the plugin's internal handler for activity privacy updates. Third, because the backend lacks a verify_user_is_owner check, the application processes the request using the shared nonce provided in the attacker's session.\nBy manipulating the parameters sent to the update function, the attacker can toggle the 'privacy' attribute of any activity stream entry. This action effectively updates the database record corresponding to the BuddyPress activity component.\nThe scope of impact is broad, as this enables unauthorized participants to expose sensitive, private communications or media uploads that were intended to be restricted to specific user groups or private visibility. The failure to restrict this operation allows for the systematic enumeration and modification of content across the entire installation. Because the vulnerability resides in the core logic of the plugin's request handling, it bypasses standard UI restrictions, allowing attackers to perform these operations via automated scripts and manual HTTP request manipulation, bypassing the intended browser-based user experience."
}