Read the docs
TI-2025-08453 Aliases CVE-2025-9218GHSA-x2wp-7759-9mc6

Missing authorization in rtCamp rtMedia for WordPress, BuddyPress and bbPress

Priority LOW 18CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rtCamprtMedia for WordPress, BuddyPress and bbPress4.7.0 – 4.7.3—No fix listedCNA
  • rtMedia for WordPress, BuddyPress and bbPress VendorrtCamp Affected 4.7.0 – 4.7.3 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9218
  2. 2026-10-03 Alias added: GHSA-x2wp-7759-9mc6

References

Other 3

  • TI-2026-12086 GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field CVSS 3.1CRITICAL 9.8
  • TI-2026-70516 Path traversal in rtMedia plugin lets attackers delete files CVSS 3.1CRITICAL 9.8
  • TI-2026-22524 WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-03088 SQL injection in rtCamp rtMedia for WordPress, BuddyPress and bbPress CVSS 3.1HIGH 8.8
  • TI-2026-47263 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2026-42512 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences