¿Es seguro Buddypress Media?

Qué hace este plugin

• Slug: buddypress-media
• 8000+ instalaciones activas

albumaudiobuddypressmediamultimedia

Estado de mantenimiento

• PHP máximo soportado (analizado): <8.0

Vulnerabilidades conocidas

7 CVEs conocidos registrados para Buddypress Media.

CVE-2026-15287

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-40773

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-25325

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through <= 4.7.8.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.19

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.19

<p>WordPress rtMedia for WordPress, BuddyPress and bbPress Plugin <= 4.6.18 is vulnerable to SQL Injection</p><p>Software: rtMedia for WordPress, BuddyPress and bbPress</p><p>Link: https://wordpress.org/plugins/buddypress-media/#developers</p><p>Affected Version <= 4.6.18</p>

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-3293

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-5931

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rtmedia_api_process_rtmedia_upload_media_request() function in all versions up to, and including, 4.6.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-5939

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Import rtMedia Settings functionality in all versions up to, and including, 4.6.15. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 12 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2023-41951	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15	Falta de control de autorización	Media 4,3	< 4.6.15	4.6.15	2023-09-06	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15	—	Desconocido	< 4.6.15	4.6.15	2023-09-04	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15	—	Desconocido	< 4.6.15	4.6.15	2023-09-04	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.2.1	—	Desconocido	< 4.2.1	4.2.1	2016-12-21	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.10.2	—	Desconocido	< 3.10.2	3.10.2	2016-01-28	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.7.40	—	Desconocido	< 3.7.40	3.7.40	2015-04-28	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.7.19	—	Desconocido	< 3.7.19	3.7.19	2014-11-24	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.7.4	—	Baja 3,7	< 4.7.4	4.7.4	0000-00-00	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.2.1	—	Desconocido	< 4.2.1	4.2.1	—	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.10.2	—	Desconocido	< 3.10.2	3.10.2	—	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15	—	Desconocido	< 4.6.15	4.6.15	—	—
—	rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15	—	Desconocido	< 4.6.15	4.6.15	—	—

CVE-2023-41951

Update the WordPress rtMedia for WordPress, BuddyPress and bbPress plugin to the latest available version (at least 4.6.15). thiennv discovered and reported this Broken Access Control vulnerability in WordPress rtMedia for WordPress, BuddyPress and bbPress Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 4.6.15.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtmedia_admin_upload function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload a settings file and modify plugin settings.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_settings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to expose sensitive information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.2.1

The rtMedia for WordPress, BuddyPress and bbPress for WordPress is vulnerable to Direct file access in versions up to, and including, 4.2. This is due to the 'rtUploadAttachment.php' file preventing direct access to the the file. This makes it possible for unauthenticated attackers to access the file directly which triggers execution and lets unauthenticated users upload files.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.10.2

The rtMedia for WordPress, BuddyPress and bbPress Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_title’ parameter in versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.7.40

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to generic SQL Injection via the ‘rtmedia_activity_upgrade’ method in versions up to, and including, 3.7.39 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 3.7.19

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.9.5 via the 'template' parameter. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.7.4

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.2.1

Changelog for 4.2.1 mentions "Security issues pointed out by James Golovich", but could not find any reference on the author's blog

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_settings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to expose sensitive information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media] < 4.6.15

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtmedia_admin_upload function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload a settings file and modify plugin settings.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Presto Player — 100000+ instalaciones activas — 96/100 (338) — PHP máx. <8.0
• Seriously Simple Podcasting — 30000+ instalaciones activas — 94/100 (329) — PHP máx. 8.4
• Compact WP Audio Player — 20000+ instalaciones activas — 82/100 (69) — PHP máx. 8.4
• AudioIgniter Music Player — 10000+ instalaciones activas — 92/100 (63) — PHP máx. 8.4
• HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player — 10000+ instalaciones activas — 92/100 (167) — PHP máx. 8.4