Executive brief
rtMedia is a popular WordPress plugin that adds media gallery functionality to WordPress sites using BuddyPress and bbPress. An unauthenticated attacker can inject malicious SQL commands through the 'compare' parameter on any public page with an rtMedia gallery shortcode, allowing them to steal sensitive database information such as user credentials or personal data. This vulnerability is easily exploitable and requires no user interaction or account.
Technical details
The vulnerability is a time-based blind SQL injection in the rtMedia plugin's RTMediaQuery::query() method, caused by insufficient escaping of the 'compare' parameter and improper SQL query preparation. The vulnerable code merges user-supplied $_REQUEST data into the internal query while only validating top-level array keys, allowing nested 'compare' values to bypass validation and reach the SQL sink. Attack preconditions are minimal: the vulnerable page must contain an rtMedia shortcode (e.g., [rtmedia_gallery]) with the rtmedia_shortcode GET parameter set, and no authentication is required. An attacker can use time-based techniques to extract sensitive data from the database or potentially execute arbitrary database operations. The vulnerability affects all versions up to and including 4.7.11; patch status is unknown from the advisory text.
Affected products
- rtMedia rtMedia for WordPress up to and including 4.7.11
Timeline
- 2026-09-12: disclosed