Advisories · Technology

rtcamp rtMedia for WordPress, BuddyPress and bbPress.

Every CVE that names rtcamp rtMedia for WordPress, BuddyPress and bbPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-89301 CVE record

CVSS 7.5 High

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
- rtcamp rtMedia for WordPress, BuddyPress and bbPress
- Broken access control
Not analysed yet 10 Oct 2026
CVE-2026-16482 CVE record

CVSS 7.5 High

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
- rtcamp rtMedia for WordPress, BuddyPress and bbPress
- SQL injection
Not analysed yet 12 Sept 2026
CVE-2026-59551 CVE record

CVSS 8.5 High

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
- rtCamp rtMedia for WordPress, BuddyPress and bbPress
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59549 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
- rtCamp rtMedia for WordPress, BuddyPress and bbPress
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-15287 CVE record

CVSS 6.5 Medium

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection
- rtcamp rtMedia for WordPress, BuddyPress and bbPress
- SQL injection
Not analysed yet 10 Jul 2026
CVE-2026-25325 CVE record

CVSS 5.3 Medium

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerability
- rtCamp rtMedia for WordPress, BuddyPress and bbPress
- Information disclosure
Not analysed yet 19 Feb 2026
CVE-2025-9218 CVE record

CVSS 3.7 Low

rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
- rtcamp rtMedia for WordPress, BuddyPress and bbPress
- Broken access control
Not analysed yet 13 Dec 2025
CVE-2023-41951 CVE record

CVSS 4.3 Medium

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.14 - Broken Access Control vulnerability
- rtCamp rtMedia for WordPress, BuddyPress and bbPress
- Broken access control
Not analysed yet 13 Dec 2024
CVE-2024-3293 CVE record

CVSS 8.8 High

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode
- rtcamp rtMedia for WordPress, BuddyPress and bbPress
- SQL injection
Not analysed yet 23 Apr 2024