CVE-2026-16482

The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to time-based blind SQL injection through the 'compare' parameter in all versions up to and including 4.7.11, caused by insufficient escaping and lack of prepared statements. Any unauthenticated attacker can trigger it by sending a crafted request to a public page that embeds an rtMedia shortcode (such as [rtmedia_gallery]) with the rtmedia_shortcode GET parameter set, since RTMediaQuery::query() merges $_REQUEST into the query while validating only top-level keys. Successful exploitation lets the attacker append additional SQL queries and extract sensitive information from the site's WordPress database, including potentially user credentials. Any WordPress site running the plugin with a rtMedia shortcode on a publicly reachable page is affected. As of now there is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

What to do: Update the rtMedia plugin to the newest release (any version newer than 4.7.11). Until patched, remove rtMedia shortcodes from public pages or use a WAF rule to block requests where the rtmedia_shortcode GET parameter is present along with nested 'compare' values. Review web server and WAF logs for requests containing the rtmedia_shortcode parameter, and check the database for signs of unexpected queries or data exfiltration.