EUVD-2026-63335
GHSA-6g76-jfv7-jr9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running rtMedia
-
DeliverySend crafted request with SQL payload
-
ExploitBypass query sanitization (CWE-89)
-
ExecutionExtract sensitive database records
-
ImpactLeverage stolen credentials/data for account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected rtMedia plugin (version 4.7.11 or earlier) must be installed and active on a network-reachable WordPress site; no authentication is required (CVSS PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L), so exploitation works against default configurations of any site running the plugin. The primary limiting factor is deployment: only sites that have this specific plugin enabled are exploitable, and sites already upgraded past 4.7.11 (once a fixed release is available) are not. No special feature-flag or non-default configuration is called out in the description beyond having the plugin active. |
| Impact | The signals are largely aligned toward a genuine priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial, remote, unauthenticated, low-complexity exploitation, and the C:H impact reflects meaningful data exposure. Two signals temper the raw 9.3 score: I:N and only A:L indicate the flaw is primarily a read/extraction and limited-availability issue rather than full database takeover, and no EPSS score was supplied so real-world exploitation probability cannot be quantified from the input. It is not in CISA KEV and no POC is referenced, so this is not confirmed active exploitation - but WordPress plugin SQLi is a heavily automated target class, so absence of a POC today offers little durable protection. Any operator running this plugin, from a small municipal IT team to a large host, should treat an unauthenticated SQLi as urgent and patch promptly rather than wait for a POC to surface. |
| Exploit ScenarioDerived | An attacker locates a public WordPress site running rtMedia and sends a crafted HTTP request carrying malicious SQL to a vulnerable plugin parameter, requiring no authentication or user interaction. The injected query extracts sensitive rows - such as usernames, password hashes, or session tokens from the WordPress database - which the attacker then uses to escalate toward account takeover. No public POC is referenced, but the low attack complexity makes this readily automatable at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it high-priority for any site running the plugin.
RemediationAI
The provided data does not include an exact fixed version, so treat remediation as: upgrade rtMedia to a release later than 4.7.11 once the patched version is confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-11-sql-injection-vulnerability?_s_id=cve) or the plugin's WordPress.org changelog. No vendor-released patch version is identified in the input, so until an upgrade is applied, apply specific compensating controls: deploy a WAF or Patchstack virtual patch with SQLi rules covering the plugin's endpoints (trade-off: rule tuning may cause false positives on legitimate media queries); restrict or deactivate the rtMedia plugin if the media features are non-essential (trade-off: loss of album/upload functionality); and place the site behind access restrictions or rate-limiting on the affected request paths to reduce automated scanning exposure. Verify database backups and rotate any secrets (auth keys, salts, admin credentials) if compromise is suspected, since C:H means credential/session data could already be exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rtMedia is a media-management plugin that adds photo, audio, and video album features to WordPress installations, integrating with the BuddyPress and bbPress social/forum frameworks (vendor rtCamp, CPE cpe:2.3:a:rtcamp:rtmedia_for_wordpress,_buddypress_and_bbpress). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a database query without proper parameterization or sanitization, allowing an attacker to alter the query's logic. Because WordPress plugins share the single site database, a SQLi in one plugin can expose data written by WordPress core and every other plugin, which is consistent with the Scope:Changed metric in the published vector.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated, network, low-complexity SQLi gives AV:N/AC:L/PR:N/UI:N; primarily data extraction so C:H, I:N/A:N, and I assess S:U as the DB stays within the WordPress security authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.
Articles & Coverage 1
Executive ViewAI
The rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) contains an unauthenticated SQL injection vulnerability that exposes the entire WordPress database to remote attackers, including user credentials, session tokens, and private media records. Any organization running this plugin faces immediate risk of credential theft, account compromise, and data breach without requiring attackers to authenticate.
No vendor-released patch identified at time of analysis. Immediately deactivate the plugin; for organizations requiring continued media functionality, restrict database access via network-level IP whitelisting and deploy WAF rules to block SQL injection payloads. Enable database transaction logging and activity monitoring to detect exploitation attempts, and maintain restrictive access controls on WordPress administrative interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB