Its foundation lies in improper neutralization of special elements used in SQL commands within the rtMedia plugin, ultimately permitting blind SQL injection. The flaw allows attackers to construct input that bypasses normal sanitization and is forwarded to the database, enabling unauthenticated execution of arbitrary SQL queries.

Affected systems are installations of the rtCamp rtMedia plugin for WordPress, BuddyPress and bbPress with versions up to 4.7.11 inclusive. Any website that has not upgraded beyond these versions is vulnerable. The vulnerability does not affect WordPress core or other plugins, only rtMedia itself.

The CVSS score of 9.3 indicates a high severity; the EPSS score is less than 1%, indicating a low public exploit probability. The vulnerability is not listed in CISA's KEV catalog. It can be exploited over the web by submitting unauthenticated HTTP requests containing the crafted SQL payload that triggers blind SQL injection. Because the flaw exists in a public-facing plugin, attackers with internet access to the target site can initiate exploitation without prior authentication.