CVE-2026-66592: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in rtCamp rtMedia for WordPress, BuddyPress and bbPress

This vulnerability (CVE-2026-66592) is an improper neutralization of special elements used in an SQL command (CWE-89) affecting rtCamp rtMedia for WordPress, BuddyPress, and bbPress versions up to 4.7.11. It permits unauthenticated attackers to perform SQL injection attacks, which can compromise database confidentiality and cause limited availability impact. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is provided, so patch status is not confirmed.

Successful exploitation can lead to unauthorized disclosure of sensitive database information (high confidentiality impact) and limited disruption of service (low availability impact). The vulnerability does not require authentication, increasing the risk of exploitation. Integrity impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider applying strict input validation and web application firewall rules to detect and block SQL injection attempts targeting rtMedia components.