Input validation vulnerability in rtMedia for WordPress, BuddyPress and bbPress 3.7.18

The rtMedia for WordPress, BuddyPress and bbPress plugin is prone to a security vulnerability that can be exploited in versions up to and including 3.7.18. Attackers who have been authenticated are able to include and run any arbitrary file on the server by using the ‘template’ parameter. This can be used to bypass security measures, gain access to sensitive data, or even execute code in cases where images and other “safe” file types can be uploaded and included.