CVE-2025-9218: 
WordPress vulnerability analysis and mitigation

CVE-2025-9218 is an information disclosure vulnerability in the rtMedia for WordPress, BuddyPress and bbPress plugin caused by missing authorization in the handle_rest_pre_dispatch() function. It affects plugin versions 4.7.0 through 4.7.3 and is only exploitable when the Godam plugin is also active. Unauthenticated attackers can retrieve media items associated with draft or private posts. The vulnerability was published on December 13, 2025, and carries a CVSS v3.1 base score of 3.7 (Low) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the handle_rest_pre_dispatch() function in RTMediaJsonApi.php fails to enforce access controls when the Godam plugin is active, allowing REST API requests to bypass authorization checks. An unauthenticated attacker can send crafted network requests to the WordPress REST API to access media associated with posts that are in draft or private status. The attack vector is network-based, requires no user interaction or privileges, but has high attack complexity — likely due to the conditional requirement that the Godam plugin be simultaneously active. A patch was applied in version 4.7.4, visible in the plugin's Trac changeset (Wordfence, WordPress Trac).

Successful exploitation results in unauthorized disclosure of media content (images, videos, audio) attached to private or draft WordPress posts, impacting confidentiality. There is no impact on integrity or availability. The scope is limited to the affected WordPress installation; lateral movement potential is low, but sensitive unpublished media (e.g., unreleased content, private user uploads) could be exposed to any unauthenticated internet user (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-9218. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The high attack complexity (requiring the Godam plugin to be active alongside the vulnerable rtMedia versions) further limits the exploitable attack surface (Wordfence).

1. Reconnaissance: Identify WordPress sites running rtMedia plugin versions 4.7.0–4.7.3 with the Godam plugin also active. This can be done by checking plugin readme files or version indicators exposed via the WordPress REST API or public plugin directories.
2. Identify REST API endpoint: Locate the rtMedia REST API endpoint exposed by the handle_rest_pre_dispatch() function (e.g., /wp-json/rtmedia/v1/media or similar endpoints registered by the plugin).
3. Send unauthenticated request: Issue an HTTP GET request to the media retrieval endpoint without any authentication credentials or session tokens.
4. Retrieve private/draft media: Due to the missing authorization check, the API returns media items associated with private or draft posts, exposing their URLs or metadata to the attacker (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated HTTP GET requests to WordPress REST API endpoints associated with rtMedia (e.g., /wp-json/rtmedia/v1/media) from external IP addresses, particularly in high volume or targeting private/draft content.
• Logs: WordPress access logs showing repeated REST API requests to rtMedia endpoints without authentication headers (Authorization or cookie-based session tokens absent); HTTP 200 responses to such requests on sites running rtMedia 4.7.0–4.7.3 with Godam active.
• File System: No file system artifacts expected for this read-only information disclosure vulnerability.

Update the rtMedia for WordPress, BuddyPress and bbPress plugin to version 4.7.4 or later, which includes the authorization fix in RTMediaJsonApi.php. If an immediate upgrade is not possible, consider deactivating the Godam plugin as a temporary workaround, since the vulnerability is only exploitable when Godam is active. Site administrators should also review WordPress REST API access controls and consider restricting unauthenticated REST API access where not required (Wordfence, WordPress Plugin Page).

The vulnerability was assigned and disclosed by Wordfence, a leading WordPress security firm, on December 13, 2025. Coverage has been picked up by standard vulnerability aggregators including VulDB, Vulners, ENISA EUVD, and INCIBE-CERT, indicating routine industry tracking. No notable researcher commentary or significant social media discussion beyond automated CVE feeds has been observed (Wordfence).