rtMedia for WordPress, BuddyPress and bbPress

rtMedia through 4.7.10 lets a Subscriber supply attacker-controlled input that reaches an SQL statement without safe parameterization. The attacker can interact with the WordPress database and potentially read or alter data available to the database user. The Patchstack CNA record does not disclose the endpoint, action, parameter, query or vulnerable function.

rtMedia through 4.7.10 lets an unauthenticated attacker supply input that reaches an SQL statement without safe parameterization. Exploitation can interact with the WordPress database and potentially read or alter data available to the database user. The Patchstack CNA record does not disclose the endpoint, action, parameter, query or vulnerable function.

rtMedia for WordPress, BuddyPress and bbPress is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.7.9. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

rtMedia for WordPress, BuddyPress and bbPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

rtMedia for WordPress, BuddyPress and bbPress is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

rtMedia for WordPress, BuddyPress and bbPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.