CVE-2026-89301

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.14

Description Insufficient file path validation in the process() function allows unauthenticated attackers to delete arbitrary safe files on the server. This is possible because the public nonce rtmedia upload nonce is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, allowing it to be retrieved by visitors without authentication.

Recommendations Update rtMedia for WordPress, BuddyPress and bbPress to version 4.7.14 or later.