What is CVE-2025-9218?

CVE-2025-9218 is a low-severity vulnerability in Rtcamp Rtmedia For Wordpress, Buddypress And Bbpress, classified under Missing Authorization. CVSS score: 3.7/10. Published 2025-12-13.

How severe is CVE-2025-9218?

Low severity. CVSS v3 base score is 3.7 out of 10.

Auth bypass in Rtcamp Rtmedia For Wordpress, Buddypress And Bbpress

CVE-2025-9218

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

Vulnerability class: Broken Access Control

EPSS: 0.003 (20.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Rtcamp Rtmedia For Wordpress, Buddypress And Bbpress — versions 4.7.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-9218?: CVE-2025-9218 is a low-severity vulnerability in Rtcamp Rtmedia For Wordpress, Buddypress And Bbpress, classified under Missing Authorization. CVSS score: 3.7/10. Published 2025-12-13.
How severe is CVE-2025-9218?: Low severity. CVSS v3 base score is 3.7 out of 10.