CVE-2026-89301: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmediauploadnonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit it. They can retrieve the required rtmedia_upload_nonce from frontend JavaScript on any page that renders an rtMedia gallery or upload shortcode.
Are sites affected if visitors can view an rtMedia gallery or upload shortcode?
Yes. The nonce is publicly exposed on pages rendering either of those rtMedia features, so no prior login or privileged action is required to obtain it.
What is the practical impact?
An attacker can delete arbitrary safe files on the server through insufficient file path validation in the upload processing flow. The described impact is limited file deletion; no integrity or availability impact beyond that is specified.
Which versions are affected?
All versions up to and including 4.7.13 are affected.