CVE-2026-15287: rtMedia WordPress Plugin SQL Injection Vulnerability (v4.6.18)

Technical summary

This is a time-based SQL injection vulnerability (CWE-89) residing in the rtMedia plugin's handling of the order_by parameter. The plugin fails to properly escape user-supplied input and does not use parameterized queries, allowing authenticated attackers to append arbitrary SQL into existing query statements. The attack requires valid WordPress authentication at subscriber level or higher, but does not require user interaction. Successful exploitation enables blind SQL injection attacks where data can be exfiltrated through time-based techniques or other inference methods.

Business impact

Organizations running WordPress sites with rtMedia installed and active face unauthorized database exposure. Attackers with even low-privilege user accounts (subscribers) can systematically extract sensitive information including user credentials, email addresses, personal data, and other stored database contents. This compromises data confidentiality and may trigger regulatory obligations under privacy laws like GDPR or CCPA. The risk is amplified if WordPress installations have numerous subscriber-level users or allow public registration.

Affected systems

The vulnerability affects rtMedia plugin versions up to and including 4.6.18 when deployed on WordPress instances that also run BuddyPress and/or bbPress. The plugin must be installed and active for exposure. Any WordPress installation with subscriber-level or higher user accounts is at risk, as authentication is required but the privilege threshold is minimal.

Exploitability

Exploitation requires valid WordPress authentication credentials at subscriber level or above, which is a relatively low barrier in many WordPress deployments. No user interaction is needed once authenticated. The attack can be executed remotely over the network. While the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, the straightforward nature of SQL injection makes this a practical attack vector for insiders or compromised low-privilege accounts. Time-based SQL injection may be slower than error-based techniques but remains reliable.

Remediation

Update the rtMedia plugin to a patched version released after 4.6.18—verify the exact version number against the official rtMedia repository or vendor advisory, as this information is not yet publicly finalized. If an immediate patch is unavailable, consider disabling the plugin temporarily or restricting subscriber-level access to trusted users only. Review WordPress user roles and remove unnecessary subscriber accounts.

Patch guidance

Monitor the rtMedia plugin's official release channel and the WordPress plugin repository for version updates addressing this vulnerability. Once available, apply patches to all affected WordPress installations without delay. Test patches in a staging environment first to ensure compatibility with your specific BuddyPress or bbPress configuration. Verify that the patched version includes proper input escaping and parameterized query usage for the order_by parameter.

Detection guidance

Monitor database query logs and WordPress security logs for unusual SQL patterns in the order_by parameter, particularly those containing SQL keywords (UNION, SELECT, WHERE, CASE, etc.). Watch for time delays in responses that may indicate time-based SQL injection probing. Track failed or suspicious queries originating from authenticated subscriber accounts. Deploy a WordPress security plugin with SQL injection detection capabilities. Review authentication logs to identify accounts with unexpected query activity.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt attention because it enables data exfiltration without requiring administrative access, and subscriber-level accounts are often numerous and less closely monitored than admin accounts. The confidentiality impact is high despite the limited impact vector. Organizations with public user registration or many subscriber accounts should prioritize faster remediation.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the requirement for authentication as a mitigating factor, combined with high confidentiality impact and no integrity or availability impact. The network attack vector and low attack complexity increase the score. However, the low privilege requirement partially offsets the severity rating, warranting careful contextualization within your organization's threat model.

Frequently asked questions