Home

Description

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

PUBLISHED Reserved 2025-08-19 | Published 2025-12-13 | Updated 2025-12-15 | Assigner Wordfence




LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

4.7.0 (semver)
affected

Timeline

2025-12-12:Disclosed

Credits

Kenneth Dunn finder

References

www.wordfence.com/...-1bdf-4104-a263-757b018af129?source=cve

wordpress.org/plugins/buddypress-media/

plugins.trac.wordpress.org/...rollers/api/RTMediaJsonApi.php

cve.org (CVE-2025-9218)

nvd.nist.gov (CVE-2025-9218)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.