EUVD-2026-96052
GHSA-p8rm-hfx6-rqv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLoad public gallery/upload page
-
ExploitHarvest rtmedia_upload_nonce from JavaScript
-
ExecutionSend crafted deletion request to endpoint
-
ImpactDelete arbitrary safe files on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress site where at least one publicly accessible page renders the rtMedia gallery or upload shortcode, because that is what emits the rtmedia_upload_nonce into frontend JavaScript for unauthenticated harvesting; without such a page the nonce is not exposed. The flaw is reachable remotely and without authentication (PR:N), but the impact is LIMITED by design to deletion of files the plugin considers 'safe' (per the description of 'limited file deletion' of 'arbitrary safe files'), not critical system or configuration files. Affected versions are rtMedia <= 4.7.13; sites on 4.7.14 or later are not exploitable. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a low-complexity, network-reachable, fully unauthenticated flaw, and the description confirms the enabling mechanism: the rtmedia_upload_nonce is emitted into frontend JavaScript on any page rendering the gallery or upload shortcode, so an unauthenticated visitor can harvest it without privileges - this is a genuine authorization gap (CWE-862). However, there is a clear internal inconsistency: the provided vector scores C:H/I:N/A:N (confidentiality-only impact), yet the vulnerability is file DELETION, which is an integrity/availability impact, not confidentiality - the C:H rating appears mis-assigned and the real-world impact is limited deletion of 'safe' files, not data disclosure. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is unproven: no public exploit identified at time of analysis. Net assessment: a credible, easily-reachable unauthenticated flaw worth patching promptly on affected sites, but the self-described 'limited'/'safe file' scope and absence of any exploitation telemetry make it a moderate rather than emergency priority - the headline 7.5 overstates true impact because of the questionable C:H metric. |
| Exploit ScenarioDerived | An unauthenticated attacker visits a public page that renders the rtMedia gallery or upload shortcode and reads the rtmedia_upload_nonce value from the page's JavaScript. Using that nonce, they issue crafted upload/processing requests to the rtMedia endpoint that trigger the file-deletion path, removing arbitrary 'safe' files from the server. No public exploit code was identified at time of analysis, and the low attack complexity means the only real prerequisite is a reachable page exposing the nonce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated attackers can delete a limited set of files on WordPress sites running the rtMedia for WordPress, BuddyPress and bbPress plugin through version 4.7.13, because the upload processing routine performs insufficient file path validation and the plugin treats a publicly exposed nonce as an authorization gate. The rtmedia_upload_nonce that guards the deletion path is emitted into frontend JavaScript by any page rendering the rtMedia gallery or upload shortcode, so it can be harvested by any anonymous visitor, although the impact is deliberately limited to files the plugin classifies as 'safe' rather than critical system or configuration files. Affected sites on 4.7.14 or later are not exploitable; no public exploit code was identified at time of analysis and there is no evidence of active exploitation. The assessing vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting limited integrity and availability loss rather than the higher confidentiality weighting in the originally published CVSS score.
RemediationAI
Vendor-released patch: upgrade rtMedia for WordPress, BuddyPress and bbPress to version 4.7.14 or later - the release at https://github.com/rtCamp/rtMedia/releases/tag/4.7.14 is the authoritative fix and is also the channel referenced by the advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ea679227-5ab3-408b-ae1b-340099880789?source=cve; update through the WordPress plugin dashboard or by replacing the buddypress-media directory, then verify the installed version shows 4.7.14+. Where immediate upgrading is not possible, the most effective compensating control is to eliminate the pre-condition rather than the code path: remove or stop rendering rtMedia gallery/upload shortcodes on any publicly accessible page (unauthenticated or low-trust roles) so rtmedia_upload_nonce is never emitted to anonymous visitors - the trade-off is that legitimate front-end media browsing and uploading for guests stops working, and the plugin's upload endpoints may still be directly reachable by anyone who obtained the nonce earlier, so treat this as temporary. Restricting the affected upload endpoint to authenticated sessions at the web-server or WAF layer also helps, but must be scoped carefully because the same endpoint serves normal logged-in media workflows and overly broad blocks break uploads. If the site has no need for front-end media management at all, deactivating the plugin removes the attack surface entirely; if it is required, keep automated backups of the WordPress uploads directory so any deleted 'safe' files can be restored, since the flaw's impact is limited to deletion of plugin-classified files rather than configuration or system data. After patching, review uploads directories and plugin logs for unexpected file removals to determine whether the flaw was exercised.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rtMedia extends WordPress, BuddyPress and bbPress with front-end media galleries, albums and uploads; the affected code lives in the plugin's upload controllers, specifically the process function in app/main/controllers/upload/processors/RTMediaUploadFile.php (lines 91, 180 and 253), reached through RTMediaUploadEndpoint.php (line 85), RTMediaUploadModel.php (line 49) and the routing in app/main/routers/RTMediaRouter.php (line 120), with the nonce emitted via app/main/controllers/shortcodes/RTMediaGalleryShortcode.php (line 151). The root-cause class is CWE-862 (Missing Authorization): WordPress nonces are CSRF-deterrent tokens, not access-control primitives, and because rtmedia_upload_nonce is a public value printed into page markup/JavaScript for anonymous visitors (WordPress nonces are only 10 characters of hash material tied to a session/user context that is not required here), verifying it does not establish that the requester is permitted to act on a given file path. Combined with insufficient path validation on the file argument, an unauthenticated request can therefore reach a deletion path for files the plugin considers 'safe'. The CPE cpe:2.3:a:rtcamp:rtmedia_for_wordpress,_buddypress_and_bbpress:*:*:*:*:*:*:*:* is unbounded, so version/range confirmation must come from the advisory and the vendor's own changelog. The 4.7.14 release notes corroborate a broad file-handling hardening effort rather than a single-line fix, listing stricter allowed-extension validation, prevention of arbitrary file sideloading, album permission checks when moving media, sanitization of media edits, and validation of media privacy levels against allowed values.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network access via a publicly exposed nonce (AV:N/AC:L/PR:N); impact is file deletion affecting integrity and availability at a limited 'safe file' scope, with no confidentiality impact (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action.
Executive ViewAI
The rtMedia for WordPress, BuddyPress and bbPress plugin, through version 4.7.13, allows unauthenticated visitors to delete a limited set of non-critical files on affected WordPress sites, affecting the integrity and availability of gallery and upload content. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, but public-facing sites remain exposed until mitigated or upgraded. Leadership should prioritize inventory and risk-based remediation because affected sites may experience content loss and must rely on interim controls.
No vendor-released patch identified at time of analysis. Disable rtMedia if not essential; remove or restrict public gallery/upload shortcodes; block anonymous deletion requests at WAF or reverse proxy; enforce authentication and authorization for upload/delete actions; monitor file integrity and logs; maintain offline backups; upgrade to rtMedia 4.7.14 or later if available and verified, as those versions are not exploitable per context.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB