An authenticated SQL injection vulnerability in the rtMedia for WordPress plugin could allow low-privileged subscribers to compromise sensitive database information.

The plugin fails to properly sanitize user-supplied input before using it in SQL commands. This flaw is exploitable by authenticated users with subscriber-level privileges, as indicated by the CVSS PR:L vector.

Successful exploitation allows an attacker to perform unauthorized database operations, potentially leading to the exposure of sensitive user data or site configuration details. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to the confidentiality of the WordPress environment.

Immediate Action: Update the rtMedia for WordPress, BuddyPress and bbPress plugin to version 4.7.11 or later.

Proactive Monitoring: Review database error logs for unusual query patterns or syntax errors that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall with SQL injection protection rules enabled to filter malicious requests targeting this plugin.

Public Exploit Available: Unknown.

The vulnerability represents a significant risk to the integrity and confidentiality of the WordPress database. Administrators should prioritize updating the rtMedia plugin to version 4.7.11 immediately to eliminate the injection flaw.