CVE-2024-3293

HIGH

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated Blind SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-3293. PoCs published by truonghuuphuc.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2024-3293, an authenticated SQL injection vulnerability in rtMedia for WordPress. It includes a call stack, payload example, and screenshots demonstrating the exploit's effectiveness.

Description

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Exploits (1)

nomisec WRITEUP 1 stars
by truonghuuphuc · poc
https://github.com/truonghuuphuc/CVE-2024-3293-Poc

This repository provides a detailed technical analysis of CVE-2024-3293, an authenticated SQL injection vulnerability in rtMedia for WordPress. It includes a call stack, payload example, and screenshots demonstrating the exploit's effectiveness.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18
Auth required
Prerequisites: Authenticated access with contributor-level permissions or higher · rtMedia plugin version <= 4.6.18 installed
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0140
EPSS Percentile 69.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
rtcamp/rtMedia for WordPress, BuddyPress and bbPress < 4.6.18
Published Apr 23, 2024
Tracked Since Feb 18, 2026