The rtMedia for WordPress, BuddyPress, and bbPress plugin prior to version 4.7.12 contains an authorization bypass vulnerability (CWE-639). This flaw arises because the plugin does not properly check if the user owns an activity before permitting changes to its privacy settings. The plugin relies only on a nonce that is shared among all logged-in users, which allows users with subscriber-level privileges or above to change the privacy level of activities and attached media belonging to other users, potentially making private content public or hiding it.

An attacker with subscriber-level access or higher can modify the privacy settings of other users' activities and attached media without proper authorization. This could lead to unauthorized disclosure of private content or unintended hiding of content, impacting confidentiality and integrity of user data. The CVSS score is 4.2 (medium severity), reflecting limited impact with low privileges required and no availability impact.

A fix is available in rtMedia version 4.7.12 and later. Users should upgrade to version 4.7.12 or newer to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.