CVE-2026-89301
HighCVSS 7.5Summary
The rtMedia plugin for WordPress, BuddyPress and bbPress up to version 4.7.13 is vulnerable to limited file deletion due to insufficient file path validation in the process function. Unauthenticated attackers can delete arbitrary safe files on the server, using a public nonce emitted in frontend JavaScript on pages with rtMedia gallery or upload shortcode.
Risk Assessment
An attacker can delete files on the server, potentially leading to site disruption or data loss.
Recommendation
Update the plugin to a patched version. If not available, restrict access to file upload functionality or apply additional path validation safeguards.
Other vulnerabilities in rtMedia for WordPress, BuddyPress and bbPress
See all- CVE-2026-59551High
SQL Injection vulnerability with subscriber privileges in the rtMedia for WordPress, BuddyPress and bbPress plugin up to version 4.7.10. Allows a user with subscriber role to execute arbitrary SQL queries.
- CVE-2026-105892Critical
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal. This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.
- CVE-2026-88912Medium
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media. It relies only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
- CVE-2026-15287Medium
The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to time-based SQL injection via the order_by parameter in all versions up to and including 4.6.18 due to insufficient escaping and lack of proper SQL query preparation.
- CVE-2026-40773Medium
Versions of rtMedia for WordPress, BuddyPress, and bbPress up to 4.7.9 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Original NVD description (English source)
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS