The rtMedia plugin for WordPress, BuddyPress, and bbPress contains a time-based SQL Injection vulnerability in the order_by parameter in all versions up to and including 4.6.18. The issue arises from insufficient escaping of user-supplied input and inadequate preparation of SQL queries, enabling authenticated attackers with subscriber-level privileges or higher to append malicious SQL commands. This can lead to unauthorized extraction of sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, and privileges required at the low level. No vendor advisory or patch information is currently available.

Authenticated users with subscriber access or higher can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the backend database. The vulnerability does not affect availability or integrity but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber-level access and monitoring for suspicious activity related to SQL injection attempts targeting the order_by parameter.