CVE-2026-105892 is a critical path traversal vulnerability in rtCamp Inc.'s rtMedia plugin for WordPress, BuddyPress, and bbPress. It allows an attacker to improperly access restricted directories by manipulating pathnames. This affects versions from the initial release up to 4.7.13. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-89301 is a high-severity vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress. It affects all versions up to and including 4.7.13. The flaw involves missing authorization checks that allow unauthenticated attackers to delete arbitrary safe files on the server by exploiting insufficient file path validation. Additionally, a public nonce used for uploads is exposed in frontend JavaScript, making it accessible to unauthenticated visitors.
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.
CVE-2026-66592 is a critical unauthenticated SQL Injection vulnerability in rtCamp rtMedia for WordPress, BuddyPress, and bbPress versions up to 4.7.11. This vulnerability allows remote attackers to inject SQL commands without authentication, potentially leading to high-impact confidentiality breaches and partial availability loss.
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-40773 is a medium severity vulnerability in rtCamp Inc.'s rtMedia plugin for WordPress, BuddyPress, and bbPress. It involves broken access control affecting subscriber roles in versions up to and including 4.7.9. This missing authorization issue could allow users with limited privileges to perform unauthorized actions that impact the integrity of the system. No official patch or remediation guidance has been provided yet.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through <= 4.7.8.
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Transcoder transcoder allows Stored XSS.This issue affects Transcoder: from n/a through <= 1.4.0.
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.