CVE-2026-59551
HighCVSS 8.5Summary
SQL Injection vulnerability with subscriber privileges in the rtMedia for WordPress, BuddyPress and bbPress plugin up to version 4.7.10. Allows a user with subscriber role to execute arbitrary SQL queries.
Risk Assessment
An attacker with a subscriber account can access the database, steal user data, or escalate privileges.
Recommendation
Update the rtMedia plugin to the latest version. Restrict subscriber permissions and use parameterized SQL queries.
Other vulnerabilities in rtMedia for WordPress, BuddyPress and bbPress
See all- CVE-2026-15287Medium
The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to time-based SQL injection via the order_by parameter in all versions up to and including 4.6.18 due to insufficient escaping and lack of proper SQL query preparation.
- CVE-2026-40773Medium
Versions of rtMedia for WordPress, BuddyPress, and bbPress up to 4.7.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Original NVD description (English source)
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.