Low severity3.7NVD Advisory· Published Dec 13, 2025· Updated Apr 15, 2026

CVE-2025-9218

Description

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Buddypress Mediareferences
Package: https://wordpress.org/plugins/buddypress-media
rtMedia/rtMediallm-create
Range: 4.7.0 to 4.7.3

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3386907/buddypress-media/tags/4.7.4/app/main/controllers/api/RTMediaJsonApi.phpnvd
wordpress.org/plugins/buddypress-media/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/68533b4c-1bdf-4104-a263-757b018af129nvd

News mentions

No linked articles in our index yet.

cvss	0.240
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000