The plugin contains a path traversal flaw that permits an attacker to delete arbitrary files from the server. This can remove critical media files, configuration files or even core WordPress files, resulting in data loss and potential service disruption. The flaw does not directly grant code execution but can lead to a denial‑of‑service scenario if essential files are removed.

rtCamp Inc.’s rtMedia for WordPress, BuddyPress and bbPress plugin versions through 4.7.13 are vulnerable. The issue applies to all installations of the plugin and can affect any user who can submit URLs to the plugin’s file handling interface.

The CVSS score of 9.8 indicates a critical severity and the EPSS score is not available, meaning there is no current exploit traffic data, yet the potential for exploitation is high. The vulnerability is not listed in CISA’s KEV catalog. Attacks are likely to occur via the web interface of the plugin; any authenticated or unauthenticated user who can trigger the file handling function can craft a malicious path traversal request and delete arbitrary files on the web server.