CVE-2026-16482: rtMedia WordPress Plugin SQLi Vulnerability

CVE-2026-16482 Overview

CVE-2026-16482 is a time-based blind SQL injection vulnerability in the rtMedia for WordPress, BuddyPress and bbPress plugin. The flaw affects all versions up to and including 4.7.11. Unauthenticated attackers can inject SQL statements through the compare parameter on any public page containing an rtMedia shortcode such as [rtmedia_gallery]. The plugin's RTMediaQuery::query() method merges $_REQUEST data into the internal query while validating only top-level array keys, letting a nested compare subvalue reach the vulnerable sink. Successful exploitation enables extraction of sensitive data from the WordPress database, including credentials and session tokens.

Critical Impact
Unauthenticated attackers can extract sensitive database contents from any WordPress site running rtMedia ≤ 4.7.11 that exposes an rtMedia shortcode on a public page.

Affected Products

rtMedia for WordPress, BuddyPress and bbPress plugin, all versions ≤ 4.7.11
WordPress sites rendering the [rtmedia_gallery] or other rtMedia shortcodes on public pages
Sites where the rtmedia_shortcode GET parameter can be supplied by unauthenticated visitors

Discovery Timeline

2026-09-12 - CVE-2026-16482 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-16482

Vulnerability Analysis

The vulnerability [CWE-89] resides in the rtMedia plugin's database query construction. When a page containing an rtMedia shortcode is requested with the rtmedia_shortcode GET parameter, the plugin invokes RTMediaQuery::query() (see app/main/routers/query/RTMediaQuery.php line 611). This method merges the entire $_REQUEST superglobal into its internal query array. The validation logic inspects only top-level array keys and does not recursively sanitize nested values.

A nested compare subvalue supplied by the attacker flows unescaped into the SQL query built by RTMediaModel (see app/helper/RTMediaModel.php lines 105 and 116). Because the query is neither escaped nor prepared, the injected fragment becomes part of the executed statement. Attackers rely on time-based payloads such as SLEEP() to infer database contents one bit at a time, bypassing the absence of visible output.

Root Cause

The root cause is insufficient escaping of the user-supplied compare parameter combined with the absence of prepared statements in the affected SQL construction path. $wpdb->prepare() is not applied to the concatenated fragment, allowing arbitrary SQL syntax to reach the MySQL server.

Attack Vector

Exploitation requires only network access to a public page rendering an rtMedia shortcode. No authentication or user interaction is required. The attacker submits a crafted GET request that includes the rtmedia_shortcode parameter and a nested array structure carrying a malicious compare value. The server executes the injected SQL, and response timing reveals the boolean result of each conditional payload. Detailed sink locations are documented in the WordPress RTMediaQuery source and the WordPress RTMediaModel source.

Detection Methods for CVE-2026-16482

Indicators of Compromise

GET requests to WordPress pages containing the rtmedia_shortcode parameter combined with nested array parameters such as compare[...].
Access log entries containing SQL keywords like SLEEP(, BENCHMARK(, UNION SELECT, or INFORMATION_SCHEMA within rtMedia-related query strings.
Anomalously long response times on pages rendering [rtmedia_gallery] or similar rtMedia shortcodes.
Repeated requests from a single source enumerating character positions, indicative of blind SQL inference.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect and block nested compare parameters carrying SQL metacharacters when rtmedia_shortcode is present.
Enable MySQL slow query and general query logging to surface unusual WHERE clauses originating from the rtMedia plugin.
Correlate WordPress access logs with database query duration to identify time-based blind SQL injection patterns.

Monitoring Recommendations

Alert on HTTP requests to pages containing rtMedia shortcodes with query strings exceeding baseline length or containing encoded parentheses.
Monitor for repeated 200-response requests from the same IP with response times clustering around fixed multiples (typical of SLEEP(n) payloads).
Track outbound data volume from the WordPress database host for anomalies consistent with mass record extraction.

How to Mitigate CVE-2026-16482

Immediate Actions Required

Upgrade the rtMedia for WordPress, BuddyPress and bbPress plugin to version 4.7.12 or later immediately.
Audit WordPress database credentials, administrator accounts, and API tokens that may have been exposed on vulnerable installations.
Review web server access logs for the indicators listed above and investigate any matching activity.

Patch Information

The plugin author released a fix in version 4.7.12. The corrective change is documented in WordPress Changeset 3652137, which updates RTDBModel to properly prepare SQL fragments. Additional advisory details are available at the Wordfence Vulnerability Record.

Workarounds

Temporarily remove or comment out rtMedia shortcodes such as [rtmedia_gallery] from public pages until the patch is applied.
Deploy a WAF rule that rejects requests containing the rtmedia_shortcode parameter combined with nested array notation on the compare key.
Restrict access to pages rendering rtMedia shortcodes to authenticated users via a maintenance plugin during the patch window.

bash

# Example WAF rule (ModSecurity) to block nested compare payloads
SecRule ARGS_NAMES "@rx ^compare\[" \
  "id:1026164820,phase:2,deny,status:403,\
  msg:'CVE-2026-16482 rtMedia SQLi attempt',\
  chain"
  SecRule ARGS:rtmedia_shortcode "@rx .+" "t:none"