VULNERABILITY INTELLIGENCE

CVE-2025-9218

CVSS score3.7 LOW
EPSS probability0.32%
CISA KEVNot currently listed
Published2025-12-13
Last modified2026-10-07
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

Weakness classification

  • security@wordfence.com: CWE-862

Primary references