# CVE-2026-15287: rtcamp rtMedia SQL injection in order_by parameter

Source: https://junglewise.ai/threats/cve-2026-15287-rtcamp-rtmedia-sql-injection-in-order-by-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-15287 · Severity: medium · CVSS 6.5 · Published 2026-07-10

rtMedia is a popular WordPress plugin used to manage media files across BuddyPress and bbPress communities. A security flaw allows logged-in users with basic permissions to run unauthorized database commands. This could lead to the theft of sensitive site information, including user data and configuration details.

Technologies: [rtCamp rtMedia](https://junglewise.ai/threats/technologies/rtmedia). Vendors: [rtCamp](https://junglewise.ai/threats/vendors/rtcamp).

## Quick answers

**Is CVE-2026-15287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15287 being exploited in the wild.

**How severe is CVE-2026-15287?** Medium severity, with a CVSS score of 6.5, published 10 July 2026.

**Which products and versions are affected?** rtCamp rtMedia <= 4.6.18.

**Is there a fix for CVE-2026-15287?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15287 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15287?** Check whether you run rtCamp rtMedia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based SQL injection vulnerability exists in rtMedia versions up to 4.6.18 due to insufficient escaping and lack of preparation on the 'order_by' parameter within SQL queries. An authenticated attacker with at least subscriber-level privileges can exploit this by sending crafted network requests to append malicious SQL commands. This allows for the extraction of sensitive data from the WordPress database through inference based on time delays. The issue has been addressed in subsequent versions via improved input sanitization and the use of prepared statements.

## Affected products

- rtcamp rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18

## Timeline

- 2026-07-10: disclosed
- 2026-07-10: advisory

## References

- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071359%40buddypress-media%2Ftrunk&old=3022114%40buddypress-media%2Ftrunk&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071359%40buddypress-media%2Ftrunk&old=3022114%40buddypress-media%2Ftrunk&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/7a2420ca-e079-429b-b1f1-47bf1d0a9f71?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/7a2420ca-e079-429b-b1f1-47bf1d0a9f71?source=cve)

## Related threats

- [rtCamp rtMedia SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-59551-rtcamp-rtmedia-sql-injection-in-wordpress-plugin)
- [rtCamp rtMedia unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-59549-rtcamp-rtmedia-unauthenticated-sql-injection)
- [rtMedia for WordPress broken access control](https://junglewise.ai/threats/cve-2026-40773-rtmedia-for-wordpress-broken-access-control)