Blind SQL Injection Vulnerability in rtMedia Plugin Affects Sensitive Data

CVE-2024-3293

Summary

The rtMedia for WordPress plugin, which supports BuddyPress and bbPress, has a vulnerability that allows for blind SQL Injection. This occurs through the rtmedia_gallery shortcode owing to inadequate escaping of user-supplied parameters and insufficient query preparation. As a result, authenticated attackers with contributor-level access or higher can inject additional SQL queries into existing ones, which may lead to unauthorized access to sensitive database information. This security flaw emphasizes the importance of proper input validation and secure coding practices in WordPress plugin development.

References