Description

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-12T08:16:23.797Z",
  "pubdate": "2026-09-12T08:16:23.797Z",
  "executiveSummary": "The rtMedia for WordPress, BuddyPress, and bbPress plugin is susceptible to a time-based blind SQL Injection vulnerability affecting all versions up to and including 4.7.11.\nThis vulnerability stems from inadequate sanitization and improper preparation of SQL queries involving the 'compare' parameter, which is processed by the RTMediaQuery::query() function.\nAn unauthenticated remote attacker can exploit this flaw by injecting malicious SQL statements through crafted HTTP requests on public pages that render an rtMedia shortcode (e.g., [rtmedia_gallery]).\nSuccessful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data exfiltration, database structure exposure, and compromise of sensitive information stored within the WordPress database.\nBecause the vulnerability is exploitable without authentication, the risk level is high, as it bypasses standard access control mechanisms by manipulating internal query merging processes.\nThe primary requirement for exploitation is the presence of an rtMedia shortcode on a publicly accessible page and the inclusion of the 'rtmedia_shortcode' GET parameter, enabling the malicious input to reach the vulnerable backend query sink.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the RTMediaQuery::query() function to adequately validate nested sub-parameters before they are incorporated into dynamic SQL queries. Specifically, the function merges the global $_REQUEST array into the plugin's internal query object while only performing validation on top-level array keys. This oversight allows an attacker to pass a nested 'compare' parameter that is not subject to necessary escaping or prepared statement logic.\nThe vulnerability occurs within the database interaction layer where the 'compare' parameter is concatenated directly into SQL query strings. Because the application lacks sufficient input preparation, the 'compare' value is treated as trusted input, permitting the injection of SQL operators and commands. By leveraging time-based blind SQL injection techniques, an attacker can construct payloads that cause the database to delay responses based on the result of conditional boolean checks, allowing for the systematic extraction of data character-by-character.\nThe attack flow begins when an attacker identifies a publicly accessible WordPress page containing an rtMedia shortcode. The attacker then crafts a malicious HTTP GET request, explicitly setting the 'rtmedia_shortcode' parameter. This triggers the vulnerable RTMediaQuery::query() logic. By embedding a SQL injection payload into the 'compare' field, the attacker forces the underlying database engine to execute injected instructions.\nThe payload utilizes time-delay functions—such as SLEEP() or its equivalent—within the injected SQL logic. If a condition specified in the payload is true, the server response is delayed by a predefined duration. By measuring these response latencies, the attacker confirms the validity of the injected queries, effectively bypassing the need for direct output to the web page. This method provides the attacker with the capability to map database tables, extract sensitive administrative credentials, or dump user information.\nAffected systems include all versions of rtMedia for WordPress, BuddyPress, and bbPress up to and including 4.7.11. The vulnerability is highly accessible as it does not require administrative privileges or session-based authentication, relying solely on the existence of publicly reachable pages utilizing the plugin's shortcode functionality."
}