CVE-2026-105892

Summary

This vulnerability allows attackers to perform path traversal attacks on rtMedia for WordPress, BuddyPress and bbPress installations, potentially enabling them to read arbitrary files from the server's filesystem. The flaw occurs due to improper limitation of pathname to a restricted directory, making it possible for attackers to access sensitive data beyond the intended media directories.

Exploitability

Exploitation is relatively straightforward with no special preconditions required, as attackers can simply craft malicious requests to traverse directories and access files through the vulnerable plugin's endpoints.

Blast radius

The impact could be significant across many WordPress installations using rtMedia, potentially exposing sensitive configuration files, database credentials, and user data if attackers successfully exploit this vulnerability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to rtMedia version 4.7.14 or later to remediate this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.