CVE-2026-89301 rtcamp CVE debrief

Who should care

Defenders responsible for WordPress installations with the rtMedia for WordPress, BuddyPress and bbPress plugin should assess exposure and prioritize patching or mitigation. This includes reviewing compensating controls for exposed systems, monitoring for suspicious file deletion activity, and tracking exceptions and retesting remediated assets.

Why it matters

CVE-2026-89301 allows unauthenticated attackers to delete arbitrary safe files on the server, potentially leading to data loss and system instability. Defenders should prioritize patching or mitigating this vulnerability, especially for systems with publicly accessible rtMedia galleries or upload shortcodes.

• Unauthenticated attackers can delete arbitrary safe files on the server
• Publicly accessible rtMedia galleries or upload shortcodes increase the attack surface
• File deletion can lead to data loss and potential system instability

Technical summary

The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to limited file deletion due to insufficient file path validation in the process function. An unauthenticated attacker can delete arbitrary safe files on the server by exploiting this vulnerability. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action. This vulnerability makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for systems with publicly accessible rtMedia galleries or upload shortcodes.

Recommended defensive actions

• Patch the rtMedia for WordPress, BuddyPress and bbPress plugin to version 4.7.14 or later
• Restrict access to rtMedia galleries and upload shortcodes to authenticated users only
• Monitor for suspicious file deletion activity on the server
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact on file deletion and the role of the public nonce in facilitating exploitation. The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13. This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server. The public nonce (rtmedia_upload_nonce) is emitted

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.