CVE-2026-16482: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmediagallery]) when the rtmediashortcode GET parameter is set, because RTMediaQuery::query() merges $REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rtMedia for WordPress, BuddyPress and bbPressto a version that resolves this vulnerability.Fixed in 4.7.11 - Compensating control
If you cannot patch immediately, reduce exposure by ensuring that public pages do not include rtMedia shortcodes (e.g., [rtmedia_gallery]) with the rtmedia_shortcode GET parameter set.
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Sites are exposed if they run rtMedia version 4.7.11 or earlier and have a publicly accessible page containing an rtMedia shortcode, such as [rtmedia_gallery]. Exploitation requires the attacker to set the rtmedia_shortcode GET parameter.
Does an attacker need an account or user interaction?
No. The vulnerability is exploitable without authentication and does not require user interaction.
What information could an attacker obtain?
The SQL injection can be used to extract sensitive information from the WordPress database. The issue is described as time-based blind SQL injection, so extraction may occur through inference from query timing.