EUVD-2026-63335
GHSA-6g76-jfv7-jr9x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated, network, low-complexity SQLi gives AV:N/AC:L/PR:N/UI:N; primarily data extraction so C:H, I:N/A:N, and I assess S:U as the DB stays within the WordPress security authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.
Articles & Coverage 1
AnalysisAI
SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected rtMedia plugin (version 4.7.11 or earlier) must be installed and active on a network-reachable WordPress site; no authentication is required (CVSS PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L), so exploitation works against default configurations of any site running the plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely aligned toward a genuine priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial, remote, unauthenticated, low-complexity exploitation, and the C:H impact reflects meaningful data exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The provided data does not include an exact fixed version, so treat remediation as: upgrade rtMedia to a release later than 4.7.11 once the patched version is confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-11-sql-injection-vulnerability?_s_id=cve) or the plugin's WordPress.org changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running rtMedia 4.7.11 or earlier and immediately deactivate the plugin; examine database access logs for the past 30 days to detect suspicious SQL queries or exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract
Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.9) permits low-privileged authen
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today