CVE-2026-15287: rtMedia WordPress Plugin SQLi Vulnerability

CVE-2026-15287 Overview

CVE-2026-15287 is a time-based SQL Injection vulnerability [CWE-89] in the rtMedia for WordPress, BuddyPress and bbPress plugin. The flaw affects all plugin versions up to and including 4.6.18. The vulnerability exists in the order_by parameter, which is not sufficiently escaped before being concatenated into an SQL query. Authenticated users with Subscriber-level access or higher can append arbitrary SQL to the existing query. Successful exploitation allows attackers to extract sensitive information from the WordPress database, including user credentials and session data.

Critical Impact
Authenticated attackers with Subscriber privileges can exfiltrate database contents using time-based SQL injection payloads through the order_by parameter.

Affected Products

rtMedia for WordPress, BuddyPress and bbPress plugin — all versions up to and including 4.6.18
WordPress sites running rtMedia with Subscriber-level (or higher) registration enabled
BuddyPress and bbPress installations integrated with vulnerable rtMedia versions

Discovery Timeline

2026-07-10 - CVE-2026-15287 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15287

Vulnerability Analysis

The vulnerability resides in query construction logic that consumes the order_by HTTP parameter without adequate sanitization. The plugin fails to escape user-supplied input and does not use parameterized statements through the WordPress $wpdb->prepare() API. As a result, attacker-controlled content is concatenated directly into the SQL ORDER BY clause. Because ORDER BY values cannot be safely bound as parameters, only strict allowlisting of column names prevents injection here. The absence of that allowlist creates the injection primitive.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin trusts the order_by request parameter and inserts it into the query string before execution. Existing query preparation logic is incomplete, leaving the sort column value unescaped.

Attack Vector

An authenticated attacker with Subscriber access sends a crafted HTTP request containing a malicious order_by value. The injected payload uses time-delay functions such as SLEEP() or BENCHMARK() to infer database contents based on response timing. Iterative requests allow blind extraction of arbitrary tables, including wp_users password hashes and session tokens. The attack requires only low-privileged authentication and is executed over the network.

No verified public exploit code is available. See the Wordfence Vulnerability Intelligence advisory for additional technical context.

Detection Methods for CVE-2026-15287

Indicators of Compromise

HTTP requests to rtMedia endpoints containing order_by parameter values with SQL keywords such as SLEEP, BENCHMARK, IF(, SELECT, or UNION.
Web server access logs showing repeated requests from the same authenticated Subscriber account with varying order_by payloads.
Abnormally long database query execution times correlated with rtMedia media listing requests.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the order_by parameter for non-alphanumeric characters and SQL syntax.
Enable MySQL slow query logging and alert on queries containing SLEEP() or BENCHMARK() originating from WordPress processes.
Monitor WordPress audit logs for Subscriber accounts issuing high volumes of media-related requests.

Monitoring Recommendations

Baseline normal order_by values used by legitimate rtMedia traffic and alert on deviations.
Correlate authentication events with subsequent database anomalies to identify low-privileged accounts probing for injection.
Review new Subscriber account registrations for automated or suspicious signup patterns.

How to Mitigate CVE-2026-15287

Immediate Actions Required

Update the rtMedia for WordPress, BuddyPress and bbPress plugin to a version newer than 4.6.18 as soon as the patched release is available.
Audit WordPress user accounts and remove or restrict unnecessary Subscriber-level access.
Rotate WordPress secret keys, salts, and administrative passwords if compromise is suspected.

Patch Information

The fix was committed to the plugin repository. Review the WordPress Trac Changeset Report for the code changes that address the injection by properly sanitizing the order_by parameter.

Workarounds

Disable open user registration or restrict Subscriber role creation until the patch is applied.
Deploy WAF rules that block requests containing SQL syntax in the order_by parameter targeting rtMedia endpoints.
Temporarily deactivate the rtMedia plugin if it is not business-critical.

bash

# Example WAF ModSecurity rule blocking SQL syntax in order_by parameter
SecRule ARGS:order_by "@rx (?i)(sleep|benchmark|select|union|;|--|/\*)" \
    "id:1015287,phase:2,deny,status:403,\
    msg:'CVE-2026-15287 rtMedia SQLi attempt in order_by'"