CVE-2026-59549

CriticalCVSS 9.3

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Summary

The rtMedia plugin for WordPress, BuddyPress, and bbPress version 4.7.10 and earlier contains an unauthenticated SQL injection vulnerability.

An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to data leakage, database modification, or site compromise.

Immediately update the rtMedia plugin to the latest version that includes a fix.

Original NVD description (English source)

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.