Key points
- CVE-2026-105892 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The flaw affects rtMedia plugin versions from release up to 4.7.13.
- Attackers can exploit improper pathname limitations to traverse directories.
Security teams must immediately inventory WordPress, BuddyPress, and bbPress environments running the rtMedia plugin. The National Vulnerability Database recorded CVE-2026-105892 as a critical severity issue. This vulnerability stems from improper limitation of a pathname to a restricted directory. It enables path traversal attacks that can expose sensitive data stored on the server.
The flaw impacts rtMedia for WordPress, BuddyPress, and bbPress versions up to 4.7.13. According to the NVD record, the weakness is categorized under CWE-22. Organizations using rtCamp Inc.'s rtMedia plugin in these version ranges are vulnerable. The vulnerability allows unauthorized access to files outside the intended directory structure.
What we know
The National Vulnerability Database assigned a CVSS score of 9.8 to CVE-2026-105892. This rating indicates a critical level of severity for the path traversal flaw. The vulnerability exists in the rtMedia plugin developed by rtCamp Inc. It affects versions from the earliest release through version 4.7.13.
The technical root cause is improper limitation of a pathname to a restricted directory. This is classified as CWE-22 in the Common Weakness Enumeration. Attackers can leverage this issue to perform path traversal. This allows them to read files that should be restricted. The exposure risks data breaches and unauthorized information disclosure.
Defender's checklist
- Verify the installed version of the rtMedia plugin on all web servers.
- Confirm if the site runs WordPress, BuddyPress, or bbPress platforms.
- Check for any unauthorized file access logs or unusual outbound traffic.
- Ensure server configurations restrict directory traversal where possible.
Background: Data breaches
Data breaches occur when unauthorized actors access sensitive information through technical vulnerabilities, human error, or insider threats. Causes include weak authentication, misconfigured cloud storage, and unpatched software. Understanding these mechanisms allows you to close specific gaps before attackers exploit them.
Read the full guide: What Causes Data Breaches: The Hidden Mechanics Behind Every Leak
What to do and how to stay safe: rtMedia
- Scan all web applications for the rtMedia plugin and check version numbers.
- Review server access logs for signs of path traversal attempts or anomalies.
- Restrict file permissions on the server to limit exposure of sensitive data.
- Monitor for new security advisories from rtCamp Inc. regarding this CVE.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of rtMedia are affected by CVE-2026-105892?
All versions of rtMedia for WordPress, BuddyPress, and bbPress up to and including version 4.7.13 are affected by this vulnerability.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-105892 as Critical with a CVSS score of 9.8.
What type of attack does this vulnerability enable?
This vulnerability allows path traversal attacks by exploiting improper limitation of a pathname to a restricted directory.
