CVE-2026-89301

Summary

The rtMedia plugin has a vulnerability where unauthenticated users can delete arbitrary safe files on the server due to insufficient file path validation. This occurs because the upload nonce is exposed in frontend JavaScript, allowing attackers to retrieve and use it without authentication.

Exploitability

Exploitation is straightforward as attackers only need to retrieve the exposed rtmedia_upload_nonce from frontend JavaScript and make a single request to trigger file deletion, with no authentication or privileged actions required.

Blast radius

The impact could be significant as attackers can delete important files like images, documents, or configuration files that are accessible via the web server, potentially affecting site functionality and user experience.

Detection

Monitor for unusual file deletion patterns in the WordPress uploads directory, particularly around the rtmedia folder, and look for HTTP requests containing the rtmedia_upload_nonce parameter with DELETE or POST methods targeting file paths.

Prioritized remediation

Upgrade to version 4.7.14 or later which contains the fix for this file deletion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.