Threats tagged 'ghsa-p8rm-hfx6-rqv3'

CVE-2026-89301 is a high-severity vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress. It affects all versions up to and including 4.7.13. The flaw involves missing authorization checks that allow unauthenticated attackers to delete arbitrary safe files on the server by exploiting insufficient file path validation. Additionally, a public nonce used for uploads is exposed in frontend JavaScript, making it accessible to unauthenticated visitors.