CVE-2026-16482
HighCVSS 7.5Summary
The rtMedia for WordPress, BuddyPress and bbPress plugin in all versions up to and including 4.7.11 is vulnerable to time-based blind SQL Injection via the 'compare' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables unauthenticated attackers to append additional SQL queries into existing queries to extract sensitive information from the database. It is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys.
Risk Assessment
The vulnerability allows an unauthenticated attacker to extract sensitive data from the database, potentially including user data and credentials. It only requires a public page with an active rtMedia shortcode.
Recommendation
Update the rtMedia plugin to a version later than 4.7.11. Until then, consider removing rtMedia shortcodes from public pages or restricting access to them.
Other vulnerabilities in rtMedia
See all- CVE-2026-66592Critical
Unauthenticated SQL Injection vulnerability in rtMedia for WordPress, BuddyPress and bbPress versions up to 4.7.11. An attacker can manipulate database queries.
- CVE-2026-59549Critical
The rtMedia plugin for WordPress, BuddyPress, and bbPress version 4.7.10 and earlier contains an unauthenticated SQL injection vulnerability.
Original NVD description (English source)
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.