A critical unauthenticated SQL injection vulnerability in the rtMedia for WordPress, BuddyPress and bbPress plugin exposes databases to unauthorized data access and potential compromise.

The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. This allows an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying WordPress database.

Successful exploitation allows an attacker to bypass authentication and extract sensitive information from the database, such as user credentials, personal data, or configuration details. With a CVSS score of 9.3, this vulnerability represents a critical risk to data confidentiality and integrity, potentially leading to a full site takeover or significant regulatory non-compliance.

Immediate Action: Update the rtMedia for WordPress, BuddyPress and bbPress plugin to version 4.7.11 or later immediately.

Proactive Monitoring: Review database error logs and web server access logs for anomalous SQL syntax patterns or unexpected query execution attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeted at WordPress plugins.

Public Exploit Available: Unknown.

Given the critical CVSS severity of 9.3 and the ease of exploitation for unauthenticated attackers, immediate patching is required. Administrators should prioritize updating the rtMedia plugin across all affected WordPress installations to prevent unauthorized data exposure and potential site compromise.