Threat database

CVE-2026-105892 is a critical path traversal vulnerability in rtCamp Inc.'s rtMedia plugin for WordPress, BuddyPress, and bbPress. It allows an attacker to improperly access restricted directories by manipulating pathnames. This affects versions from the initial release up to 4.7.13. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-40773 is a medium severity vulnerability in rtCamp Inc.'s rtMedia plugin for WordPress, BuddyPress, and bbPress. It involves broken access control affecting subscriber roles in versions up to and including 4.7.9. This missing authorization issue could allow users with limited privileges to perform unauthorized actions that impact the integrity of the system. No official patch or remediation guidance has been provided yet.