rtMedia: Blind SQL Injection (CVE-2026-66592)
A Blind SQL Injection vulnerability, CVE-2026-66592, has been found in the rtMedia for WordPress, BuddyPress and bbPress plugin (buddypress-media) by rtCamp. Its CVSS score is 9.3.
Checked in Shield: no
Who is affected
All plugin versions up to and including 4.7.11 are affected. WordPress sites with rtMedia installed are at risk.
How to check
In the WordPress admin, open the Plugins page and find rtMedia. If the version is 4.7.11 or lower, the site is affected.
How to fix
The source does not name a fixed version. Watch for a plugin update and install a release newer than 4.7.11 once available. Until then, consider temporarily deactivating the plugin.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version and whether the flaw is exploited in the wild are not disclosed yet; source: NVD.
