This vulnerability (CVE-2026-59551) is an SQL Injection issue classified under CWE-89 affecting rtCamp rtMedia plugin for WordPress, BuddyPress, and bbPress. It impacts versions up to 4.7.10 and allows a user with subscriber privileges to inject malicious SQL commands due to improper sanitization of inputs used in SQL queries. The CVSS v3.1 score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (S:C), with high confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild or vendor patches are currently reported.

An attacker with subscriber-level access can exploit this vulnerability to execute arbitrary SQL commands on the backend database, potentially exposing sensitive data (high confidentiality impact). The vulnerability does not allow modification of data (no integrity impact) but may cause limited disruption (low availability impact). The scope of impact extends beyond the vulnerable component, affecting other components in the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted users. Follow vendor channels for updates on patches or official mitigations.