PatchSiren

rtcamp CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM rtcamp CVE published 2026-07-10

CVE-2026-15287

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18. This vulnerability allows authenticated attackers, with subscriber access and above, to append additional SQL queries into existing queries, potentially leading to sensitive information extraction from the database.