rtMedia for WordPress, BuddyPress and bbPress Information Disclosure Vulnerability

A vulnerability allowing information disclosure has been identified in the rtMedia for WordPress, BuddyPress and bbPress plugin, specifically in versions 4.7.0 to 4.7.3. The issue arises from missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active. This vulnerability enables unauthenticated attackers to access media items linked to draft or private posts.

Impact

Exploitation of this vulnerability could lead to unauthorized access to media items associated with draft or private posts.

Remediation

Users can update to rtMedia version 4.7.4 or a newer patched version to address this vulnerability.