Breaking access control rules in the rtMedia plugin for WordPress, BuddyPress and bbPress allows a subscriber-level user to view, edit, or delete media files beyond their authorized scope, directly compromising confidentiality, integrity, and potentially availability of user-generated content. The flaw is an instance of CWE‑862 and can lead to unauthorized disclosure or alteration of media assets. Attackers could expose sensitive media or remove valuable content, undermining user trust and platform reliability.

The vulnerability affects installations of the rtMedia plugin from rtCamp Inc. running any version 4.7.9 or older on WordPress, BuddyPress, or bbPress sites. All sites using these legacy versions are susceptible, regardless of the number of users or the size of the media library.

With a CVSS score of 6.5, the issue rates as a moderate severity. The EPSS score is below 1%, indicating a very low probability that exploit code is actively used in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to hold a valid subscriber account, which can often be gained through social engineering or brute force, so the risk remains contingent on the attacker’s ability to obtain or create such credentials. Once authenticated, the attacker can leverage the broken access control to manipulate media, posing a significant threat to content integrity.