The vulnerability is a classic SQL injection flaw in the subscriber handling logic of the rtMedia WordPress plugin, classified as CWE‑89. An attacker who can manipulate the influencer parameter in HTTP requests can inject arbitrary SQL, potentially reading, modifying, or deleting data stored in the WordPress database. The injection occurs during subscriber processing, and the official description does not mention any authentication requirement, implying that the exploit is likely possible from an unauthenticated user. The result is a compromise of confidentiality and integrity of the site’s data, which may lead to broader control of the WordPress installation.

The rtCamp rtMedia for WordPress, BuddyPress and bbPress plugin distributions for WordPress installations with a version of 4.7.10 or earlier are affected. Any WordPress site that has not yet upgraded past the indicated version and is running this plugin is at risk.

The CVSS score of 8.5 places this issue in the high severity range. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote HTTP request to the plugin’s subscriber endpoint, possibly via crafted query strings or form submissions. Because the vulnerability appears to allow unauthenticated exploitation, the scalability of the attack is high; if authentication is required, privilege escalation remains possible for legitimate site users. Overall, the combination of a high CVSS and a remote trigger without requiring advanced preparation makes this a serious threat for vulnerable sites.