rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-89301 · Microsoft / collected KEV context

cve-program · CVE-2026-89301

• https://www.wordfence.com/threat-intel/vulnerabilities/id/ea679227-5ab3-408b-ae1b-340099880789?source=cve
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/processors/RTMediaUploadFile.php#L91
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/RTMediaUploadEndpoint.php#L85
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/RTMediaUploadModel.php#L49
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/processors/RTMediaUploadFile.php#L180
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/upload/processors/RTMediaUploadFile.php#L253
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/routers/RTMediaRouter.php#L120
• https://plugins.trac.wordpress.org/browser/buddypress-media/tags/4.7.13/app/main/controllers/shortcodes/RTMediaGalleryShortcode.php#L151
• https://github.com/rtCamp/rtMedia/releases/tag/4.7.14

No related operational record is retained in the current change model.