Description

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-20T12:16:33.057Z",
  "pubdate": "2026-08-20T12:16:33.057Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in the rtMedia for WordPress, BuddyPress and bbPress plugin.\nThe vulnerability allows remote, unauthenticated attackers to inject malicious SQL statements into database queries, potentially leading to unauthorized data extraction, database manipulation, and complete compromise of the underlying WordPress database.\nThe affected systems include rtMedia for WordPress, BuddyPress and bbPress versions 4.7.11 and prior.\nThis flaw poses severe risk implications, as it does not require user authentication or interaction, lowering the barrier for exploitation by malicious actors scanning for vulnerable WordPress instances.\nSuccessful exploitation grants attackers the ability to bypass security controls and interact directly with the database layer.",
  "technicalDetails": "The vulnerability stems from improper sanitization and lack of parameterization of user-supplied input before it is concatenated into database queries within the rtMedia for WordPress, BuddyPress and bbPress plugin.\nThe affected versions are <= 4.7.11.\nThe attack vector is network-based via HTTP requests, requiring no authentication or specific user privileges.\nThe root cause is located in the handling of input parameters that are passed directly to database abstraction layers without adequate type casting or use of prepared statements such as $wpdb->prepare().\nDuring the attack flow, an unauthenticated threat actor sends a specially crafted HTTP request containing malicious SQL syntax to a vulnerable endpoint exposed by the plugin.\nBecause the application fails to validate or sanitize the input, the payload is directly processed by the database management system as part of a SQL query.\nThe payload behavior allows for techniques such as UNION-based SQL injection, error-based extraction, or blind inference, enabling the retrieval of sensitive information stored in the WordPress database, including password hashes, user metadata, and other plugin-specific tables.\nPost-exploitation impact includes unauthorized read and write access to the database, potential privilege escalation via credential extraction, and secondary vectors leading to remote code execution if administrative sessions can be compromised."
}