title: rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE
description: The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
vendor: Unknown
product: rtMedia for WordPress, BuddyPress and bbPress
versions:
status: affected, versionType: semver, version: 0, lessThan: 4.6.16
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}