Rtmedia For Wordpress Buddypress And Bbpress
Monthly
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it high-priority for any site running the plugin.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Horizontal privilege escalation in rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.12 allows any authenticated subscriber-level user to alter the privacy settings of other users' activities and attached media. The plugin's privacy-change endpoint validates only a WordPress nonce that is shared across all logged-in users, performing no ownership verification against the requesting account. A publicly available exploit for this flaw has been disclosed via WPScan, enabling unauthorized exposure of private media or suppression of public content across a community site's user base.
Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.9) permits low-privileged authenticated users at the subscriber level to invoke privileged plugin functionality without authorization, yielding high integrity impact. The CVSS vector (PR:L, I:H, AV:N, AC:L, UI:N) confirms that any logged-in subscriber can exploit this remotely without complexity or user interaction, making sites with open user registration particularly exposed. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it high-priority for any site running the plugin.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Horizontal privilege escalation in rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.12 allows any authenticated subscriber-level user to alter the privacy settings of other users' activities and attached media. The plugin's privacy-change endpoint validates only a WordPress nonce that is shared across all logged-in users, performing no ownership verification against the requesting account. A publicly available exploit for this flaw has been disclosed via WPScan, enabling unauthorized exposure of private media or suppression of public content across a community site's user base.
Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.9) permits low-privileged authenticated users at the subscriber level to invoke privileged plugin functionality without authorization, yielding high integrity impact. The CVSS vector (PR:L, I:H, AV:N, AC:L, UI:N) confirms that any logged-in subscriber can exploit this remotely without complexity or user interaction, making sites with open user registration particularly exposed. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.