Vulnerabilities and security researches forbuddypress-media buddypress-media

Direction: ascending

Jun 07, 2024

rtMedia for WordPress, BuddyPress and bbPress # 486aa334-badc-4af2-abe0-77904d768b90

CVE, Research URL: 486aa334-badc-4af2-abe0-77904d768b90
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: -
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.2.1 trMedia for WordPress <= 4.2 - Unspecified Issues Changelog for 4.2.1 mentions "Security issues pointed out by James Golovich", but could not find any reference on the author's blog
Affected versions: max 4.2.1.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # CVE-2023-5931

CVE, Research URL: CVE-2023-5931
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Dec 27, 2023
Research Description: The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server
Affected versions: max 4.6.16.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # CVE-2023-5939

CVE, Research URL: CVE-2023-5939
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Dec 27, 2023
Research Description: The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.
Affected versions: max 4.6.16.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # CVE-2024-3293

CVE, Research URL: CVE-2024-3293
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Apr 23, 2024
Research Description: The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 4.6.19.
Status: vulnerable

Jun 10, 2024

rtMedia for WordPress, BuddyPress and bbPress # CVE-2023-41951

CVE, Research URL: CVE-2023-41951
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Dec 13, 2024
Research Description: Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14.
Affected versions: max 4.6.15.
Status: vulnerable

Feb 27, 2026

rtMedia for WordPress, BuddyPress and bbPress # CVE-2026-25325

CVE, Research URL: CVE-2026-25325
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Feb 19, 2026
Research Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through <= 4.7.8.
Affected versions: max 4.7.9.
Status: vulnerable

Apr 25, 2026

rtMedia for WordPress, BuddyPress and bbPress # CVE-2025-9218

CVE, Research URL: CVE-2025-9218
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Dec 13, 2025
Research Description: The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.
Affected versions: max 4.7.4.
Status: vulnerable

May 03, 2026

rtMedia for WordPress, BuddyPress and bbPress # CVE-2026-40773

CVE, Research URL: CVE-2026-40773
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: -
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.7.10 CVE-2026-40773
Affected versions: max 4.7.10.
Status: vulnerable

Jun 16, 2026

rtMedia for WordPress, BuddyPress and bbPress # bfaeabe4-053e-4fe4-a7f3-25fd7a22a985

CVE, Research URL: bfaeabe4-053e-4fe4-a7f3-25fd7a22a985
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: -
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.10.2 wpscan.com
Affected versions: max 3.10.2.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 3f18519f-b365-47ea-83a2-8c5edad8f4bb

CVE, Research URL: 3f18519f-b365-47ea-83a2-8c5edad8f4bb
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: -
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.7.40 wpscan.com
Affected versions: max 3.7.40.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 6fa535e572b66737c3d2bfee4afd1a6bb64ebce1

CVE, Research URL: 6fa535e572b66737c3d2bfee4afd1a6bb64ebce1
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Dec 21, 2016
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.2.1 rtMedia for WordPress, BuddyPress and bbPress <= 4.2 - Arbitary File Upload The rtMedia for WordPress, BuddyPress and bbPress for WordPress is vulnerable to Direct file access in versions up to, and including, 4.2. This is due to the 'rtUploadAttachment.php' file preventing direct access to the the file. This makes it possible for unauthenticated attackers to access the file directly which triggers execution and lets unauthenticated users upload files.
Affected versions: max 4.2.1.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 1a157965a0f37af382c77b71540c9b26120df286

CVE, Research URL: 1a157965a0f37af382c77b71540c9b26120df286
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Nov 24, 2014
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.7.19 rtMedia for WordPress, BuddyPress and bbPress <= 3.9.5 - Local File Inclusion The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.9.5 via the 'template' parameter. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected versions: max 3.7.19.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # f26b62b1a86e8e1698814d4e4607c4e3503f2643

CVE, Research URL: f26b62b1a86e8e1698814d4e4607c4e3503f2643
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Sep 04, 2023
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15 rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization to Sensitive Information Exposure The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_settings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to expose sensitive information.
Affected versions: max 4.6.15.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # ffdddc95082595fdad5630cd21ab83043f72918b

CVE, Research URL: ffdddc95082595fdad5630cd21ab83043f72918b
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Sep 04, 2023
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15 rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization to Settings Update The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtmedia_admin_upload function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload a settings file and modify plugin settings.
Affected versions: max 4.6.15.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # fd7762b5-fdb6-4308-8eb0-3eeda46c6033

CVE, Research URL: fd7762b5-fdb6-4308-8eb0-3eeda46c6033
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: -
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15 rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Sensitive Information Exposure The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_settings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to expose sensitive information.
Affected versions: max 4.6.15.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 01fd71d45c51e769af3ccf32ac48d96cc1f2ebd7

CVE, Research URL: 01fd71d45c51e769af3ccf32ac48d96cc1f2ebd7
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Apr 28, 2015
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.7.40 rtMedia for WordPress, BuddyPress and bbPress < 3.7.40 - SQL Injection The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to generic SQL Injection via the ‘rtmedia_activity_upgrade’ method in versions up to, and including, 3.7.39 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 3.7.40.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 679822fd36ea8e97094d8993c1818b0b8db18a77

CVE, Research URL: 679822fd36ea8e97094d8993c1818b0b8db18a77
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Apr 29, 2024
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.19 WordPress rtMedia for WordPress, BuddyPress and bbPress Plugin <= 4.6.18 is vulnerable to SQL Injection WordPress rtMedia for WordPress, BuddyPress and bbPress Plugin <= 4.6.18 is vulnerable to SQL InjectionSoftware: rtMedia for WordPress, BuddyPress and bbPressLink: https://wordpress.org/plugins/buddypress-media/#developersAffected Version <= 4.6.18
Affected versions: max 4.6.19.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 30282f7b2bf7de914a51f2ce2faaf09f026cd0b0

CVE, Research URL: 30282f7b2bf7de914a51f2ce2faaf09f026cd0b0
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Jan 28, 2016
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.10.2 rtMedia for WordPress, BuddyPress and bbPress <= 3.10.1 - Cross-Site Scripting The rtMedia for WordPress, BuddyPress and bbPress Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_title’ parameter in versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 3.10.2.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 80fa3af7-1028-4f21-b5c4-f0e3350f7106

CVE, Research URL: 80fa3af7-1028-4f21-b5c4-f0e3350f7106
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: -
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15 rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Settings Update The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtmedia_admin_upload function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload a settings file and modify plugin settings.
Affected versions: max 4.6.15.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # 7fdf6c7528334ba684cec9ce491941343e648028

CVE, Research URL: 7fdf6c7528334ba684cec9ce491941343e648028
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Apr 29, 2024
Research Description: rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.19 rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 4.6.19.
Status: vulnerable

Jul 12, 2026

rtMedia for WordPress, BuddyPress and bbPress # CVE-2026-15287

CVE, Research URL: CVE-2026-15287
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Jul 10, 2026
Research Description: The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 4.6.19.
Status: vulnerable

Jul 29, 2026

rtMedia for WordPress, BuddyPress and bbPress # CVE-2026-59549

CVE, Research URL: CVE-2026-59549
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Jul 27, 2026
Research Description: Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Affected versions: max 4.7.11.
Status: vulnerable

rtMedia for WordPress, BuddyPress and bbPress # CVE-2026-59551

CVE, Research URL: CVE-2026-59551
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Jul 27, 2026
Research Description: Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Affected versions: max 4.7.11.
Status: vulnerable

Aug 22, 2026

rtMedia for WordPress, BuddyPress and bbPress # CVE-2026-66592

CVE, Research URL: CVE-2026-66592
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Aug 20, 2026
Research Description: Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.
Affected versions: max 4.7.12.
Status: vulnerable

Sep 13, 2026

rtMedia for WordPress, BuddyPress and bbPress # CVE-2026-16482

CVE, Research URL: CVE-2026-16482
Home page URL: Security reports for rtMedia for WordPress, BuddyPress and bbPress
Application: rtMedia for WordPress, BuddyPress and bbPress
Date: Sep 12, 2026
Research Description: The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.
Affected versions: max 4.7.12.
Status: vulnerable