CVE-2026-66592
validatedZero produced an exploit or a check.GHSA-6g76-jfv7-jr9x ↗EUVD-2026-63335 ↗
description
rtMedia buddypress-media versions through 4.7.11 are affected by a blind SQL injection flaw. An unauthenticated remote attacker may be able to influence database queries where the affected functionality is exposed.
mitigation
Disable the affected plugin or restrict access to its exposed functionality to trusted users and networks until a vendor update addressing the issue can be deployed. Review affected WordPress sites for unnecessary public access to rtMedia features.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-08-20 12:07Zcve.org record for CVE-2026-66592
- 2026-10-26vulncheck_kev: trigger signal, started the run
- 2026-10-26 00:00Z
- 2026-10-26 19:24Z
this entry in the feed
GET /api/v1/feed/CVE-2026-66592
{ "etk_id": "ETK-2026-2681", "cve_id": "CVE-2026-66592", "display_id": "CVE-2026-66592", "ghsa_id": "GHSA-6g76-jfv7-jr9x", "euvd_id": "EUVD-2026-63335", "status": "published", "anchor_state": "anchored", "title": "Blind SQL injection in rtMedia buddypress-media", "summary": "rtMedia buddypress-media versions through 4.7.11 are affected by a blind SQL injection flaw. An unauthenticated remote attacker may be able to influence database queries where the affected functionality is exposed.", "mitigation": "Disable the affected plugin or restrict access to its exposed functionality to trusted users and networks until a vendor update addressing the issue can be deployed. Review affected WordPress sites for unnecessary public access to rtMedia features.", "vendor": "rtCamp Inc.", "product": "rtMedia for WordPress, BuddyPress and bbPress", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 4.7.11" ], "ecosystem": null, "fixed_versions": [], "package_name": "buddypress-media", "purl": null } ], "cwes": null, "cvss_score": 9.3, "cvss_src": "other", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.0096911, "t0_at": "2026-08-20T12:07:00.502000+00:00", "signals": { "check": { "at": "2026-10-26T19:24:08.079558+00:00", "days": 67.30355992543981, "is_lower_bound": false, "measured_at": "2026-08-20T12:07:00.502000+00:00", "url": null }, "kev": { "at": "2026-10-26T00:00:00+00:00", "days": 67, "is_lower_bound": false, "measured_at": "2026-08-20T12:07:00.502000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-66592" }, "trigger_signal": { "at": "2026-10-26T00:00:00+00:00", "days": 66.4951330787037, "is_lower_bound": false, "measured_at": "2026-08-20T12:07:00.502000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-66592" } } }
published 2026-10-26 19:24Z
last change 2026-10-26 21:51Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.