{"id":"CVE-2026-89301","published":"2026-10-10T05:16:40.403","lastModified":"2026-10-13T13:29:12.567","description":"The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/rtCamp/rtMedia/releases/tag/4.7.14","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/shortcodes/RTMediaGalleryShortcode.php#L151","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/RTMediaUploadEndpoint.php#L85","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/RTMediaUploadModel.php#L49","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/processors/RTMediaUploadFile.php#L180","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/processors/RTMediaUploadFile.php#L253","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/processors/RTMediaUploadFile.php#L91","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/routers/RTMediaRouter.php#L120","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea679227-5ab3-408b-ae1b-340099880789?source=cve","tags":[]}],"exploitRefs":[{"url":"https://github.com/rtCamp/rtMedia/releases/tag/4.7.14","tags":[]}],"hasPoc":true,"ai":{"summary":"The rtMedia plugin has a vulnerability where unauthenticated users can delete arbitrary safe files on the server due to insufficient file path validation. This occurs because the upload nonce is exposed in frontend JavaScript, allowing attackers to retrieve and use it without authentication.","exploitability":"Exploitation is straightforward as attackers only need to retrieve the exposed rtmedia_upload_nonce from frontend JavaScript and make a single request to trigger file deletion, with no authentication or privileged actions required.","blast_radius":"The impact could be significant as attackers can delete important files like images, documents, or configuration files that are accessible via the web server, potentially affecting site functionality and user experience.","remediation":"Upgrade to version 4.7.14 or later which contains the fix for this file deletion vulnerability.","detection":"Monitor for unusual file deletion patterns in the WordPress uploads directory, particularly around the rtmedia folder, and look for HTTP requests containing the rtmedia_upload_nonce parameter with DELETE or POST methods targeting file paths.","tags":["file-delete","wp-plugin","unauth"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:59:51.420Z"}}