EUVD-2026-42796
GHSA-h6m2-rr3q-j8hh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible endpoint requires only subscriber authentication (PR:L); blind SQLi is read-only with no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Time-based blind SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions up to and including 4.6.18) allows authenticated attackers with subscriber-level access or higher to exfiltrate sensitive data from the WordPress database via the order_by parameter. The low authentication bar - any registered user qualifies - combined with a network-accessible attack vector and high confidentiality impact makes this a meaningful risk for community or membership sites with open user registration enabled. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique (time-based blind SQLi) is well-understood and requires no specialized tooling.
Technical ContextAI
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), manifesting specifically as time-based blind SQL injection. The order_by parameter passed to the plugin's internal query layer is neither properly escaped nor prepared using parameterized queries, allowing an attacker to append additional SQL logic - typically leveraging MySQL's SLEEP() or BENCHMARK() functions - to infer database contents through response timing. The affected plugin, rtMedia (WordPress plugin slug: buddypress-media), extends WordPress, BuddyPress, and bbPress with media management capabilities (photo, video, audio uploads). Because WordPress itself uses MySQL/MariaDB, successful exploitation grants read access to the entire wp_ database, including user credential hashes, emails, plugin-stored data, and configuration. The WordPress plugin repository SVN changeset at revision 3071359 (buddypress-media/trunk) represents the upstream fix.
RemediationAI
Update the rtMedia plugin to a version released after 4.6.18 as soon as a patched release is published to the WordPress plugin repository; the underlying code fix is confirmed in SVN changeset 3071359 but a formally tagged release version is not independently confirmed from available data - monitor the plugin's changelog at https://wordpress.org/plugins/buddypress-media/#developers. If immediate patching is not possible, the highest-impact compensating control is disabling WordPress user registration (Settings > General > uncheck 'Anyone can register'), which eliminates the primary attack path for external actors. Deploying a WordPress WAF such as Wordfence with SQL injection rules enabled will detect and block time-based SQLi patterns in the order_by parameter, with the trade-off that WAF rules can be bypassed by sufficiently obfuscated payloads. Restricting rtMedia's media-listing endpoints to higher privilege roles (Editor/Administrator) via plugin settings or custom capability checks would further constrain exploitation but may break expected subscriber functionality. See the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7a2420ca-e079-429b-b1f1-47bf1d0a9f71 for updates on patch availability.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today