rtMedia CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review rtMedia CVE published 2026-10-14

CVE-2026-88927

The rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.14 allows users with a subscriber-level account or above to inject media into another user's private album, which can be attributed to that user. This issue arises from the plugin's failure to verify that a user owns or has permission to write to the album an upload is assigned to.