Executive brief
rtMedia is a popular WordPress plugin used to manage media files across BuddyPress and bbPress communities. A security flaw allows logged-in users with basic permissions to run unauthorized database commands. This could lead to the theft of sensitive site information, including user data and configuration details.
Technical details
A time-based SQL injection vulnerability exists in rtMedia versions up to 4.6.18 due to insufficient escaping and lack of preparation on the 'order_by' parameter within SQL queries. An authenticated attacker with at least subscriber-level privileges can exploit this by sending crafted network requests to append malicious SQL commands. This allows for the extraction of sensitive data from the WordPress database through inference based on time delays. The issue has been addressed in subsequent versions via improved input sanitization and the use of prepared statements.
Affected products
- rtcamp rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory