CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14.
Explanation of Vulnerability in Simple Terms
rtMedia for WordPress, BuddyPress and bbPress versions up to 4.6.14 fail to properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read data they should not have access to. The plugin does not validate authorization on sensitive operations, allowing information disclosure.
What an attacker can do
Read sensitive data or media files that should be restricted to higher-privilege users.
Potential impact on your site
Private or restricted media and user data may be exposed to low-privilege site members who should not see it.
Conditions required to exploit
Attacker must be logged in to the WordPress site with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
