CVE-2026-89301

{
  "etk_id": "ETK-2026-1159",
  "cve_id": "CVE-2026-89301",
  "display_id": "CVE-2026-89301",
  "ghsa_id": "GHSA-p8rm-hfx6-rqv3",
  "euvd_id": "EUVD-2026-96052",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file deletion in rtMedia",
  "summary": "rtMedia for WordPress, BuddyPress and bbPress through version 4.7.13 is affected by insufficient file-path validation. An unauthenticated attacker may delete files considered safe by the plugin when a publicly accessible page renders an rtMedia gallery or upload shortcode, exposing the required nonce.",
  "mitigation": "Update to a vendor release later than 4.7.13 if one is available. Until then, remove or restrict public access to pages rendering rtMedia gallery or upload shortcodes and disable the plugin where feasible.",
  "vendor": "rtcamp",
  "product": "rtMedia for WordPress, BuddyPress and bbPress",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.7.13"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "rtMedia for WordPress, BuddyPress and bbPress",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0043,
  "epss_percentile": 0.3583,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 63.25993931666667,
  "t0_at": "2026-10-10T04:26:49.111000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-10T04:26:49.111000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T04:26:49.111000+00:00",
      "url": "https://github.com/advisories/GHSA-p8rm-hfx6-rqv3"
    }
  }
}