This vulnerability (CVE-2026-66592) involves improper neutralization of special elements used in SQL commands (CWE-89) in rtCamp rtMedia for WordPress, BuddyPress, and bbPress. It affects all versions up to and including 4.7.11. The flaw allows unauthenticated attackers to perform SQL Injection, which can lead to unauthorized disclosure of sensitive data (confidentiality impact is high) and limited denial of service (availability impact is low). The CVSS v3.1 score is 9.3, reflecting its critical severity and ease of exploitation (network vector, no privileges or user interaction required). There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database due to SQL Injection. The vulnerability does not directly impact integrity but can cause limited denial of service. The high CVSS score indicates a critical risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as restricting access to vulnerable endpoints or employing Web Application Firewalls (WAF) with SQL Injection detection rules specific to this product.