CVE-2026-25325: 
WordPress vulnerability analysis and mitigation

CVE-2026-25325 is a Sensitive Data Exposure vulnerability in the rtMedia for WordPress, BuddyPress and bbPress plugin (slug: buddypress-media) developed by rtCamp. It allows unauthenticated remote attackers to retrieve embedded sensitive system information that should not be accessible to regular users. All plugin versions up to and including 4.7.8 are affected; version 4.7.9 contains the fix. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Feedly).

The vulnerability is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), mapped to CAPEC-170 (Web Application Fingerprinting). The flaw allows unauthenticated network-based attackers to retrieve sensitive data embedded within the plugin's responses without requiring any privileges or user interaction. The attack complexity is low, meaning no special conditions or race conditions are needed to exploit it. No detailed public technical write-up or proof-of-concept code has been published as of the time of this report (Patchstack, Feedly).

Successful exploitation results in unauthorized disclosure of sensitive system information, limited to a confidentiality impact (no integrity or availability impact). The exposed data could be leveraged by attackers to fingerprint the target environment and facilitate further attacks against the WordPress installation or underlying infrastructure. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting large numbers of WordPress sites regardless of their size or popularity (Patchstack, Feedly).

The vendor (rtCamp) has released version 4.7.9 of the rtMedia for WordPress, BuddyPress and bbPress plugin, which resolves this vulnerability. Site administrators should update the plugin to version 4.7.9 or later immediately via the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository. If an immediate update is not possible, consider disabling the plugin until the update can be applied, or contact your hosting provider for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher Doan Dinh Van on January 2, 2026, and published by Patchstack on February 1, 2026. Patchstack classifies this as a low-priority issue with no impactful threat, though it notes the class of vulnerability is commonly used in mass-exploit campaigns. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).