CVE-2026-16482

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.

• CWE-89

• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.11/app/helper/RTMediaModel.php#L105
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.11/app/helper/RTMediaModel.php#L116
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.11/app/main/routers/query/RTMediaQuery.php#L611
• https://plugins.trac.wordpress.org/changeset/3652137/buddypress-media/tags/4.7.12/app/helper/db/RTDBModel.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/53d9b351-ba17-431a-b371-7dc1a87bd757?source=cve

Published

Sep 12, 2026

Last Modified

Sep 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1647The Comment Genius plugin for WordPress is vulnerable to Ref…6.1
• CVE-2026-16471Missing Authorization vulnerability in Dolusoft Software Tec…7.5
• CVE-2026-16473A flaw was found in the sbc library (BlueZ SBC codec). An of…4.3
• CVE-2026-1648The Performance Monitor plugin for WordPress is vulnerable t…7.2
• CVE-2026-16480IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is …7.1
• CVE-2026-16481A Server-Side Request Forgery (SSRF) and credential exfiltra…6
• CVE-2026-16484A flaw has been found in SourceCodester Class and Exam Timet…7.3
• CVE-2026-16485A vulnerability has been found in SourceCodester Class and E…4.3
• CVE-2026-16486A vulnerability was found in SourceCodester Class and Exam T…4.3
• CVE-2026-16488A vulnerability was determined in QUSETIONS MiniCode-Python …5
• CVE-2026-16489A vulnerability was identified in jsforce up to 3.10.16. Thi…5.3
• CVE-2026-1649The Community Events plugin for WordPress is vulnerable to S…4.4