CVE-2025-9218
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The rtMedia for WordPress, BuddyPress and bbPress plugin versions 4.7.0 to 4.7.3 is vulnerable to information disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active. This allows unauthenticated attackers to retrieve media items associated with draft or private posts.
Risk Assessment
Unauthenticated attackers could access private media, potentially leading to disclosure of confidential content.
Recommendation
Update the rtMedia plugin to a version newer than 4.7.3 if a fix is available. Check if the Godam plugin is necessary.
Other vulnerabilities in rtMedia
See all- CVE-2026-59549Critical
The rtMedia plugin for WordPress, BuddyPress, and bbPress version 4.7.10 and earlier contains an unauthenticated SQL injection vulnerability.
- CVE-2026-16482High
The rtMedia for WordPress, BuddyPress and bbPress plugin in all versions up to and including 4.7.11 is vulnerable to time-based blind SQL Injection via the 'compare' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables unauthenticated attackers to append additional SQL queries into existing queries to extract sensitive information from the database. It is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys.
Original NVD description (English source)
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS