rtMedia WordPress Plugin CVE-2026-40773

Requires a valid WordPress account with at minimum the subscriber role - the lowest authenticated tier. Sites with open user registration (Settings > General > 'Anyone can register' enabled) are at highest risk, as attackers can self-register. Sites restricting registration to invitation or administrator approval significantly reduce exploitability. The rtMedia plugin must be installed and active on the WordPress instance. No specific non-default configuration of rtMedia itself appears required beyond its presence. What limits exploitation: authentication barrier (PR:L - a valid account is mandatory), no confidentiality impact (C:N - data theft is not the consequence), and scope is unchanged (S:U - lateral movement to other WordPress components is not implied by available data).

The CVSS 6.5 Medium score reflects the network-accessible, low-complexity, low-privilege attack profile with high integrity impact and no confidentiality or availability consequences. Real-world risk is elevated for any WordPress site with open registration enabled, since an attacker could self-register as a subscriber and immediately exploit the flaw without social engineering. Sites restricting registration to trusted users face lower practical risk. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread or targeted active exploitation at time of analysis. No POC exploit code has been identified. The missing authorization class (CWE-862) is highly automatable in theory - once the vulnerable endpoint is identified, exploitation is trivial and scriptable - but the requirement for a valid subscriber account limits mass exploitation unless combined with self-registration abuse.

An attacker registers a free subscriber account on a WordPress site running rtMedia <= 4.7.9 with open registration enabled, then sends a crafted authenticated HTTP request to a privileged rtMedia AJAX endpoint - such as media deletion or album management - that lacks authorization checks, successfully modifying or deleting other users' media content without requiring editor or administrator privileges. No public POC is currently known, but the CWE-862 class is straightforward to exploit once the unprotected action hook is identified through plugin source code review.