The rtMedia plugin for WordPress, BuddyPress, and bbPress contains a flaw that allows unauthorized parties to retrieve sensitive information embedded in media objects. Classified as CWE‑497, the weakness demonstrates that private data can be accessed without the appropriate controls. An attacker who exploits this flaw could read information that should belong to other users, compromising confidentiality and potentially violating compliance obligations.

All installations of rtMedia for WordPress, BuddyPress, and bbPress version 4.7.8 or earlier are vulnerable. This range covers every release of the plugin from its launch through the latest 4.7.8 release.

The vulnerability receives a CVSS score of 5.3, indicating moderate severity. The likelihood of exploitation is very low, with an EPSS estimate below 1 %. It is not recorded in the CISA KEV catalog. The description does not specify a precise attack path, but it may be exploitable by users who can submit crafted requests to the plugin, such as through direct URL manipulation or exposed form inputs that reveal media metadata.