Ghostwire

CVE-2026-105892: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for...

CRITICAL CVSS 9.8 Exploit Available

Published: October 10, 2026 | Last Modified: October 10, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

Ghostwire Analysis — What This Means Practically

Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpres
www.tenable.com/cve/CVE-2026-105892
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-105892