# CVE-2026-40773: rtMedia for WordPress broken access control

Source: https://junglewise.ai/threats/cve-2026-40773-rtmedia-for-wordpress-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-40773 · Severity: medium · CVSS 6.5 · Published 2026-06-15

rtMedia is a WordPress plugin used to manage media files within community-driven websites. A security flaw allows logged-in users with low-level 'Subscriber' permissions to perform actions they should not be authorized to do. This could lead to unauthorized changes to site content or media settings, potentially disrupting community operations.

Technologies: [rtCamp rtMedia](https://junglewise.ai/threats/technologies/rtmedia). Vendors: [rtCamp](https://junglewise.ai/threats/vendors/rtcamp).

## Quick answers

**Is CVE-2026-40773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40773 being exploited in the wild.

**How severe is CVE-2026-40773?** Medium severity, with a CVSS score of 6.5, published 15 June 2026.

**Which products and versions are affected?** rtCamp rtMedia <= 4.7.9.

**Is there a fix for CVE-2026-40773?** A patch was published on 2026-04-21: Version 4.7.10 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40773 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-40773?** Check whether you run rtCamp rtMedia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The rtMedia plugin for WordPress (versions 4.7.9 and below) contains a broken access control vulnerability classified as CWE-862 (Missing Authorization). The flaw exists because the plugin fails to properly validate user permissions or implement sufficient nonce checks on certain functions. An attacker authenticated with Subscriber-level privileges can exploit this over the network to execute actions typically reserved for higher-privileged users, specifically impacting data integrity. The issue is resolved in version 4.7.10.

## Affected products

- rtMedia rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9

## Timeline

- 2026-03-09: other: Reported by Jakub Herman
- 2026-04-21: advisory: Initial advisory published by Patchstack
- 2026-04-21: patched: Version 4.7.10 released
- 2026-06-15: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-9-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-9-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [rtCamp rtMedia SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-59551-rtcamp-rtmedia-sql-injection-in-wordpress-plugin)
- [rtCamp rtMedia unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-59549-rtcamp-rtmedia-unauthenticated-sql-injection)
- [rtcamp rtMedia SQL injection in order_by parameter](https://junglewise.ai/threats/cve-2026-15287-rtcamp-rtmedia-sql-injection-in-order-by-parameter)