by Kastro
Paper/Archive/CVE-2026-105892

CVE-2026-105892

rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress — WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.2.352 × 207.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

Affected

ProductAffectedFixed inSource
rtMedia for WordPress, BuddyPress and bbPress≤ 4.7.13–CNA

Scores by source

Patchstack (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpatchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-13-arbitrary-file-deletion-vulnerability?_s_id=cve