CVE-2026-15287
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to time-based SQL injection via the order_by parameter in all versions up to and including 4.6.18 due to insufficient escaping and lack of proper SQL query preparation.
Risk Assessment
An authenticated attacker with subscriber-level access or higher can append additional SQL queries, potentially extracting sensitive information from the database, such as user credentials or other confidential data.
Recommendation
Immediately update the rtMedia plugin to a version newer than 4.6.18 once a patch is released. Until then, restrict subscriber account access and monitor SQL queries for suspicious activity.
Other vulnerabilities in rtMedia for WordPress, BuddyPress and bbPress
See all- CVE-2026-59551High
SQL Injection vulnerability with subscriber privileges in the rtMedia for WordPress, BuddyPress and bbPress plugin up to version 4.7.10. Allows a user with subscriber role to execute arbitrary SQL queries.
- CVE-2026-40773Medium
Versions of rtMedia for WordPress, BuddyPress, and bbPress up to 4.7.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Original NVD description (English source)
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.