In a word, yes. Originally ( in the 8086 ) it was called DMA, or Direct Memory Access. Back then there was a dedicated DMA controller chip that the CPU had to program to transfer data between ram and peripherals, but at least as far back as the early PCI days ( and I think on the original ISA bus too, but I don't know of any devices that did ), peripherals themselves could also be bus masters, and transfer the data themselves.
They still normally require the cpu to tell them what parts of memory they should access, but some badly behaved devices, such as firewire controllers, open up DMA access to all of the system's ram at the behest of some external device on the firewire bus. Some modern PCIe systems have smart PCIe bridges that can be programmed to perform address translation and access restrictions so the CPU can prevent devices connected behind them from accessing memory they shouldn't, but this currently seems restricted to big server type motherboards, not your typical desktop.
As for how, the PCI(e) bus allows any device to perform read/write to any address, be it in the main system ram ( typically controlled directly by the CPU these days ), or on some other device on the bus. That is, one PCI(e) device can directly access the memory or registers of another PCI(e) device, or main system ram, without regard to where it is located. The PCI(e) bridges route the request to the appropriate device, as they are configured ( by the system firmware/bios, and possibly later by the OS kernel ) to know what address ranges are "owned" by what device.