Orgs Face 9.8 CVSS Risk: rtMedia Path Traversal Exposes WordPress, BuddyPress, bbPress Data

A severe path traversal vulnerability in the widely used rtMedia plugin poses an immediate data exposure risk for organizations running WordPress, BuddyPress, or bbPress platforms. According to the National Vulnerability Database, this flaw allows attackers to bypass directory restrictions and access sensitive files outside the intended web root. Small-business owners relying on these platforms for customer engagement or internal communications must assess their exposure immediately, as the potential for unauthorized data access is high.

The risk

The National Vulnerability Database assigns CVE-2026-105892 a CVSS score of 9.8, categorizing it as Critical. This high severity rating reflects the ease with which an attacker can exploit the flaw without requiring authentication or user interaction. The underlying weakness, identified as CWE-22, involves improper limitation of a pathname to a restricted directory. Attackers can manipulate file paths to traverse up the directory tree, potentially reading configuration files, database credentials, or other sensitive system data. This type of exploitation can lead to full site compromise or data breaches.

Who is exposed

The vulnerability specifically affects rtMedia for WordPress, BuddyPress, and bbPress versions ranging from the earliest releases through version 4.7.13. Organizations using any version prior to 4.7.14 are directly exposed to this path traversal attack. rtCamp Inc. is the vendor responsible for the rtMedia plugin, which is commonly used to manage media galleries and social networking features on these platforms. Businesses that have not updated their plugins to a patched version remain vulnerable to exploitation. The widespread adoption of WordPress and its ecosystem means many small businesses may be running affected versions without realizing the specific risk.

Cost and compliance

The National Vulnerability Database records do not specify financial costs or regulatory penalties associated with CVE-2026-105892. However, a successful exploitation leading to data exposure could trigger compliance reviews under frameworks such as GDPR or CCPA, depending on the nature of the data accessed. Organizations must consider the potential operational disruption and reputational damage associated with a data breach. The critical CVSS score of 9.8 indicates a high likelihood of exploitation, which could increase insurance premiums or lead to legal scrutiny if customer data is compromised.

What happens next

Managers should immediately audit their WordPress, BuddyPress, and bbPress installations to determine if rtMedia is installed and which version is active. If the installed version is 4.7.13 or lower, prioritize updating to the latest available version provided by rtCamp Inc. Monitor server logs for unusual file access patterns that may indicate exploitation attempts. Engage with your IT provider or security team to verify that all plugin updates are applied promptly and that backup procedures are in place.

Background: National Vulnerability Database

The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.

Read the full guide: National Vulnerability Database Explained: How NVD Works for You

What to do and how to stay safe: rtMedia

• Audit your WordPress, BuddyPress, and bbPress installations to check for the rtMedia plugin and verify its version number.
• Update the rtMedia plugin to the latest version released by rtCamp Inc. once an update is confirmed to address CVE-2026-105892.
• Review server access logs for suspicious file traversal attempts or unauthorized access to sensitive directories.
• Ensure that regular backups of your site are current and stored securely to facilitate recovery in case of a breach.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-105892?

CVE-2026-105892 is a critical path traversal vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress, allowing attackers to access restricted files.

Which versions of rtMedia are affected?

All versions of rtMedia for WordPress, BuddyPress, and bbPress up to and including version 4.7.13 are affected by this vulnerability.

How severe is this vulnerability?

The National Vulnerability Database rates CVE-2026-105892 as Critical with a CVSS score of 9.8, indicating a high risk of exploitation.