CVE-2025-9218CWE-862broken-access-control

CVE-2025-9218

Low · published December 13, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
23.8
In the wild
Unconfirmed
What it is

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-13T21:16Z
References (3)
https://plugins.trac.wordpress.org/changeset/3386907/buddypress-media/tags/4.7.4/app/main/controllers/api/RTMediaJsonApi.php · [email protected]https://wordpress.org/plugins/buddypress-media/#developers · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/68533b4c-1bdf-4104-a263-757b018af129?source=cve · [email protected]
EPSS history
Timeline
  • 13 DEC 04:31Z
    rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
    cvelistv5