PT-2026-57064 · WordPress · Rtmedia

Peter Thaleikis · CVE-2026-15287 · Published 2026-07-10 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.6.19

Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. Authenticated attackers with subscriber-level access or higher can manipulate the order by parameter to append malicious SQL queries and extract sensitive information from the database.

Recommendations Update rtMedia for WordPress, BuddyPress and bbPress to version 4.6.19 or later. As a temporary mitigation, restrict access to the functionality utilizing the order by parameter for users with subscriber-level permissions.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-15287

Affected Products

Rtmedia

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-15287 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071359%40buddypress-media%2Ftrunk&old=3022114%40buddypress-media%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7a2420ca-e079-429b-b1f1-47bf1d0a9f71?source=cve · Note
• https://t.me/cveNotify/194568 · Telegram Post