CVE-2026-40773
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Versions of rtMedia for WordPress, BuddyPress, and bbPress up to 4.7.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Risk Assessment
Organizations may be exposed to unauthorized access to user data, potentially leading to privacy breaches and loss of trust.
Recommendation
It is recommended to update rtMedia to the latest version to mitigate this security vulnerability.
Other vulnerabilities in rtMedia for WordPress, BuddyPress and bbPress
See all- CVE-2026-59551High
SQL Injection vulnerability with subscriber privileges in the rtMedia for WordPress, BuddyPress and bbPress plugin up to version 4.7.10. Allows a user with subscriber role to execute arbitrary SQL queries.
- CVE-2026-15287Medium
The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to time-based SQL injection via the order_by parameter in all versions up to and including 4.6.18 due to insufficient escaping and lack of proper SQL query preparation.
Original NVD description (English source)
Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.