External risk intelligence

rtMedia for WordPress Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66592

The vulnerability affects a WordPress plugin, which is typically deployed as a public-facing web application. Since web plugins are designed to extend the functionality of sites accessible over the internet, the vulnerable code is commonly exposed to public web traffic.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability allows unauthenticated attackers to inject SQL commands into websites using a specific WordPress plugin, potentially leading to unauthorized data access or disruption. The primary concern is to confirm if this plugin is in use within your digital assets and assess any resulting exposure.

SQL injection flaw found in a popular plugin.
Protects sensitive data and site integrity.
Confirm usage and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target unauthenticated users to inject malicious SQL commands into a vulnerable WordPress plugin. This occurs when the plugin processes user input without proper sanitization, allowing for unauthorized access and manipulation of the underlying database. The vulnerability can lead to severe data breaches and potential disruption of service.

No authentication required for attack.
SQL injection via unsanitized input.
Leads to data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

This unauthenticated SQL injection vulnerability could allow an attacker to access or manipulate sensitive database information when the rtMedia plugin is used. The impact depends on the specific database structure and the privileges granted to the plugin.

Database information could be accessed.
Via unauthenticated network requests.
Unauthorized data disclosure may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the rtMedia plugin for WordPress affects public-facing websites, making it a concern for application owners and infrastructure teams responsible for web services. The immediate first step is to identify all instances of the affected plugin, assess their exposure and business criticality, and then coordinate with the platform or vendor management teams to plan remediation, likely involving an update or mitigation.

Application owners should manage the issue.
Verify plugin reachability and business impact.
Plan updates or implement temporary mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rtMedia for WordPress, BuddyPress and bbPress?

This is a comprehensive media management plugin that allows WordPress users to upload, share, and organize photos, videos, and music. It is designed to extend community features on social networking sites built with BuddyPress or forum sites using bbPress, turning standard WordPress installations into media-rich collaborative platforms.

What does SQL injection mean for CVE-2026-66592?

Classified as CWE-89, this vulnerability occurs when the plugin fails to properly clean user-provided input before using it in database queries. This flaw allows an attacker to insert their own SQL commands into the application, tricking the database into revealing sensitive stored information or performing unintended operations.

How does an attacker trigger this vulnerability?

The flaw is triggered by sending specially crafted, unauthenticated network requests to the vulnerable plugin. It is important to note that this does not require a user to log in or hold any administrative privileges; the vulnerability exists in the way the plugin handles incoming data streams from the web.

Why is this CVE concerning for my website?

According to Halo Surface Signal, this plugin is typically used on public-facing sites, meaning the vulnerable code is likely reachable by internet traffic. Because no authentication is required to initiate the attack, any site running the affected versions is broadly accessible to remote actors, increasing the potential risk to your database security.

Do I need to take action if I use this plugin?

Yes, you should immediately inventory your digital assets to confirm if any sites are running the affected versions. Once confirmed, prioritize these instances based on their business criticality and coordinate with your team to apply vendor-supplied updates or temporary mitigations to secure your database against unauthorized access.

References

patchstack.com/database/wordpress/plugin/buddypress-media/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.