rtMedia EUVD-2026-100859

Exploitation requires an authenticated account at subscriber level or above on the target WordPress site (PR:L), so sites that disable open registration or restrict rtMedia upload capabilities are largely protected. The specific prerequisite is use of rtMedia's album upload feature where the attacker supplies the target album identifier; the plugin fails to check that the requesting user owns or may write to that album. Impact is limited to integrity - placing media into another user's private album and misattributing authorship - with no confidentiality or availability consequence. The practical limiting factor is the need for a valid low-privileged account, which bounds this to community/multi-author deployments with self-registration enabled.

This is a low-to-moderate severity authorization flaw (IDOR, CWE-639) that signals point consistently toward low real-world urgency rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) confirms network reachability with low attack complexity and no user interaction, but requires an authenticated subscriber-level account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. EPSS is very low at 0.16% (5th percentile), and CISA SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial' - all aligning with a non-wormable, manually-triggered abuse rather than mass exploitation. The one elevating factor is that public exploit/detail exists via WPScan, so weaponization effort is reduced; however, no CISA KEV listing and no evidence of active exploitation exist. Net assessment: a genuine but contained authorization bug on multi-author/community WordPress sites - worth patching in routine cycles, but not an emergency. All core signals agree (low EPSS, SSVC none, I:L only); there is no major conflict to reconcile beyond noting the 'Authentication Bypass' tag overstates the issue, which is actually an authorization/IDOR weakness.

On a WordPress site running rtMedia with open subscriber registration, an attacker registers a free subscriber account, then crafts a media upload request that assigns the upload to an album ID owned by a different user. Because the plugin does not verify album ownership, the media is placed into the victim's private album and attributed to the victim. A public write-up exists at WPScan, lowering the effort to reproduce the request.