CVE-2026-16482: Blind SQL Injection in rtMedia Plugin

The rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) contains a critical security flaw identified as CVE-2026-16482. This vulnerability is a time-based blind SQL injection caused by insufficient input escaping and lack of parameterized queries within the RTMediaQuery::query() method. Attackers can exploit this by injecting malicious SQL statements into the compare parameter. Because the plugin incorrectly merges the $_REQUEST array into the internal query while only validating top-level keys, an unauthenticated attacker can supply nested subvalues that reach the vulnerable SQL execution sink. This is specifically exploitable on any publicly accessible WordPress page containing an rtMedia shortcode, such as [rtmedia_gallery], when the rtmedia_shortcode GET parameter is present. Successful exploitation permits unauthorized access to sensitive database contents, posing a high risk to the confidentiality of stored data.

Attack Chain

1. Attacker identifies a public-facing WordPress page containing an rtMedia shortcode (e.g., [rtmedia_gallery]).
2. Attacker crafts a malicious HTTP GET request targeting the identified page.
3. Attacker appends the rtmedia_shortcode parameter to the URL to trigger the vulnerable code path.
4. Attacker injects a malicious payload into the compare parameter, formatted as a nested subvalue (e.g., compare[field]=value).
5. The server-side RTMediaQuery::query() function receives the request and improperly merges the input into a database query.
6. The backend SQL database processes the injected time-based command (e.g., SLEEP() or BENCHMARK()).
7. Attacker observes the differential in HTTP response time to confirm successful injection and exfiltrate data character-by-character.

Impact

Successful exploitation allows unauthenticated remote attackers to perform unauthorized database queries. This can lead to the full extraction of sensitive WordPress site data, including user credentials, configuration details, and private content, directly impacting the confidentiality of the affected organization.

Recommendation

• Update the rtMedia for WordPress, BuddyPress and bbPress plugin to the latest patched version immediately.
• Use the provided Sigma rule to monitor web server logs for suspicious parameter patterns associated with this vulnerability.
• Implement a Web Application Firewall (WAF) rule to inspect and block incoming GET requests containing recursive or nested parameter keys associated with SQL injection attempts.