CVE-2026-89301
Received Received - Intake

Arbitrary File Deletion in rtMedia WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-89301
EUVD
EUVD-2026-96052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rtcamp rtMedia for WordPress, BuddyPress and bbPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The rtMedia plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in versions up to 4.7.13. Unauthenticated attackers can delete arbitrary safe files on the server by exploiting a public nonce emitted into frontend JavaScript on pages with rtMedia galleries or upload shortcodes.

Detection Guidance

Check if the rtMedia plugin version is 4.7.13 or lower. Look for unauthorized file deletions or suspicious activity in server logs. Inspect frontend JavaScript for exposed rtmedia_upload_nonce values.

Impact Analysis

This vulnerability allows unauthenticated attackers to delete important files on your server, potentially causing data loss, disrupting services, or compromising system integrity. It could lead to unauthorized modifications or deletion of media files, albums, or other plugin-related data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file deletion on the server. Unauthenticated attackers could delete arbitrary safe files, which may include sensitive data such as personal information or protected health information, violating data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Update the rtMedia plugin to version 4.7.14 or later immediately. Remove any exposed rtmedia_upload_nonce values from frontend JavaScript. Review server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89301. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart