Critical Path Traversal Flaw in rtMedia Plugin Exposes WordPress Sites to Data Breach

The National Vulnerability Database (NVD) published a record for CVE-2026-105892, identifying a critical path traversal vulnerability in the rtMedia plugin developed by rtCamp Inc. This security flaw affects installations of rtMedia for WordPress, BuddyPress, and bbPress that are running version 4.7.13 or any earlier version. The disclosure highlights a significant risk for websites relying on this media management tool.

According to the NVD record, the vulnerability is assigned a CVSS score of 9.8, which falls into the critical severity category. The underlying weakness is classified under CWE-22, known as Improper Limitation of a Pathname to a Restricted Directory. This classification indicates that the software fails to properly restrict access to files outside of the intended directory structure. Attackers can exploit this misconfiguration to traverse the file system.

Technical Context and Impact

The path traversal flaw allows unauthorized users to read sensitive files stored on the server hosting the affected plugin. By manipulating file paths in requests, an attacker can bypass intended restrictions and access data that should remain protected. The NVD description specifies that this issue exists in the rtMedia plugin for WordPress, BuddyPress, and bbPress. The vulnerability has been present in all versions leading up to 4.7.13.

Security researchers rate this issue as critical due to the potential for severe data exposure. A CVSS score of 9.8 suggests that the attack vector is likely network-based and requires no user interaction to exploit. The lack of proper input validation in the pathname handling creates a direct path for attackers to access restricted directories. This type of vulnerability often leads to the leakage of configuration files or source code.

Affected Versions and Scope

The vulnerability specifically impacts rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress. The NVD record states that the issue affects versions from the initial release through version 4.7.13. Any website running rtMedia on this version or lower is potentially vulnerable to exploitation. The scope includes both WordPress sites using the plugin for media management and BuddyPress sites utilizing the buddypress-media functionality.

Administrators of these platforms must verify their current plugin version immediately. The NVD data does not indicate a version number where the fix was introduced, only that 4.7.13 is the last affected version listed. This implies that versions prior to 4.7.13 are also vulnerable. The widespread use of WordPress and BuddyPress means that many organizations may be exposed to this critical flaw without realizing the specific risk associated with their media plugin.

What should you do?

Site administrators should audit their plugin inventory to identify if rtMedia is installed. If the plugin is present, they must check the version number against the affected range. Until a confirmed patch is available from the vendor, reducing the attack surface by limiting file permissions on the server can mitigate some risks. Monitoring access logs for unusual file traversal attempts is also recommended.