rtMedia WordPress plugin: Path traversal leading to arbitrary file deletion

Summary

The rtMedia plugin for WordPress, BuddyPress and bbPress, up to and including version 4.7.13, contains a path traversal vulnerability (CWE-22). According to the CVSS vector, an unauthenticated attacker can exploit it over the network to delete arbitrary files on the web server, which can break the website. Patchstack rates the issue as high priority and expects exploitation, but the public sources do not mark it as known exploited.

Affected

• rtMedia for WordPress, BuddyPress and bbPress, versions from n/a through 4.7.13
• Lower bound of the affected range: Unknown.
• Related CVE-2026-89301 affects the same versions and is a separate limited file deletion via sideloading.

Fixed in

• Version 4.7.14 or later (per Patchstack and the vendor's WordPress.org and GitHub listings).
• Note: No changelog names this CVE explicitly; the fix mapping is not yet confirmed by an official rtCamp advisory.

Workaround

• Unknown. No vendor or verified workaround is documented.
• Patchstack mentions a mitigation rule that blocks attacks until the plugin is updated, if the Patchstack service is in use.

Exploitation

• Not known to be exploited in the wild; not listed in CISA KEV.
• CISA SSVC: Exploitation none, automatable yes, technical impact total.
• EPSS 0.0041 (Rapid7 data).
• No public proof-of-concept found in the research.

Our recommendation

• Inventory WordPress sites that run rtMedia and check for version 4.7.13 or earlier.
• Update rtMedia to version 4.7.14 or later immediately and verify the fix against the Patchstack advisory.
• If an update is not possible at once, deactivate the plugin or restrict access to it as a temporary measure.
• If the plugin is not needed, remove it.
• Review file integrity and backups for deleted files and monitor the Patchstack and rtCamp channels.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• WordPress.org plugin listing wordpress.org
• GitHub release 4.7.14 github.com
• HOL Guard CVE entry hol.org
• Strix CVE entry www.strix.ai
• Rapid7 via Vulners (EPSS) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:44.