Skip to content
OpenAdvisories
Low · 3.7 CVE-2025-9218 EUVD-2025-203220GHSA-x2wp-7759-9mc6

rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function

Published Dec 13, 2025 · Updated Dec 15, 2025 · Assigned by Wordfence

Description

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

Affected products

VendorProductAffectedFixed
rtcamp rtMedia for WordPress, BuddyPress and bbPress 4.7.0 – ≤ 4.7.3 —

References