PT-2025-51084 · Unknown+3 · Buddypress+3

Kenneth Dunn · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-9218

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions 4.7.0 through 4.7.3

Description The rtMedia plugin for WordPress, BuddyPress, and bbPress has an information disclosure issue. Missing authorization within the handle rest pre dispatch() function, specifically when the Godam plugin is active, allows unauthenticated attackers to access media items linked to draft or private posts.

Recommendations Update to version 4.7.4 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-9218

Affected Products

Buddypress

Godam

Bbpress

Rtmedia

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-9218 · Security Note
• https://t.me/CVEtracker/39698 · Telegram Post
• https://twitter.com/VolerionSec/status/1999877644909760846 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3386907/buddypress-media/tags/4.7.4/app/main/controllers/api/RTMediaJsonApi.php · Note
• https://twitter.com/CVEnew/status/1999865361395810407 · Twitter Post
• https://wordpress.org/plugins/buddypress-media/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/68533b4c-1bdf-4104-a263-757b018af129?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1999895568143790275 · Twitter Post