CVE-2026-59549 describes an unauthenticated SQL Injection vulnerability (CWE-89) in rtMedia for WordPress, BuddyPress, and bbPress, affecting versions up to 4.7.10. The vulnerability allows remote attackers to inject SQL commands without requiring authentication, potentially compromising data confidentiality. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level is currently documented.

The vulnerability permits unauthenticated remote attackers to execute SQL injection attacks, which can lead to unauthorized disclosure of sensitive information (high confidentiality impact). Integrity is not impacted, and availability impact is low. This could allow attackers to access or extract database contents without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints or applying temporary protective measures such as web application firewalls with SQL injection detection rules. Monitor vendor communications closely for updates.