Vulnerabilities in WordPress Plugins

High and critical security vulnerabilities have been identified in WordPress plugins. These deficiencies could allow for unauthorized file deletion or exposure of sensitive information, compromising the confidentiality and integrity of affected websites. Affected Products - rtMedia for WordPress, BuddyPress and bbPress, versions 4.7.13 and earlier. - Divi Plus, versions 2.4.0 and earlier Impact The vulnerabilities have been identified as: - CVE-2026-105892: with a score of 9.8 in CVSS v3.1. There is a directory traversal vulnerability affecting the rtMedia for WordPress plugin that could allow a malicious actor to delete arbitrary files from the server by manipulating file paths. A successful exploit could compromise the integrity and availability of the website, including the deletion of files necessary for its operation. - CVE-2026-91136: with a score of 7.5 in CVSS v3.1. There is an arbitrary file read vulnerability affecting the Divi Plus plugin due to insufficient authorization controls and inadequate validation of the svg_image parameter in the REST endpoint /wp-json/elicus/v1/dipl-modules/svg-animator. An unauthenticated remote malicious actor could exploit this deficiency to read files accessible by the web server process, including configuration files that might contain sensitive information. Recommendation - Identify WordPress installations using the affected plugins and verify their versions. - Apply the corrected versions confirmed by the developers or by the corresponding security advisories. References - https://nvd.nist.gov/vuln/detail/CVE-2026-105892 - https://nvd.nist.gov/vuln/detail/CVE-2026-91136 - https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-13-arbitrary-file-deletion-vulnerability?_s_id=cve - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0bbdf6-afaf-4194-ada2-24d142892c32?source=cve