rtMedia CVE-2026-105892

Requires the rtMedia for WordPress, BuddyPress and bbPress plugin (buddypress-media) at version 4.7.13 or earlier to be installed and active on a WordPress site. Exploitation targets the plugin's media/file-handling functionality with a path-traversal payload to delete files outside the intended directory. The published vector states PR:N (no authentication), but the Patchstack 'arbitrary file deletion' classification suggests an authenticated session may in practice be required - authentication level could not be confirmed from the available data and should be verified against the vendor advisory. No user interaction (UI:N) is indicated.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) yields a 9.8 Critical score implying unauthenticated remote exploitation with full CIA impact. However, these signals conflict with the corroborating source: the only reference (Patchstack) titles this an 'arbitrary file deletion vulnerability,' which is an integrity/availability issue rather than a confidentiality one - the C:H in the vector is questionable for a file-deletion primitive. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis. Real-world risk is therefore moderate-to-high but NOT confirmed-critical: the vulnerability class (CWE-22 path traversal enabling file deletion, potentially of wp-config.php leading to site takeover) is genuinely serious, but the PR:N designation should be verified - WordPress plugin file-operation flaws of this type reported by Patchstack very commonly require at least a low-privileged authenticated session (Subscriber/Contributor), which would meaningfully reduce exposure. Treat the 9.8 as an upper bound pending confirmation of the authentication precondition with the vendor/Patchstack advisory.

A remote attacker sends a crafted request to the rtMedia plugin containing a path-traversal sequence (e.g. '../../') in a filename or media-handling parameter, causing the plugin to resolve and delete a file outside its intended upload directory. Deleting a core file such as wp-config.php can force WordPress back into its installation routine, enabling full site takeover. No public proof-of-concept was provided in the source data.