EUVD-2026-44879
GHSA-344h-fqfm-3mrj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor role is PR:L not PR:H; impact limited to post title read, so C:L; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.
AnalysisAI
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the Contributor role to enumerate private, draft, pending, scheduled, and trashed posts authored by other users. The root cause is a missing capability check in an AJAX handler that resolves a caller-supplied post identifier directly - a classic IDOR (CWE-639) pattern. No public exploit is in CISA KEV, but a publicly available proof-of-concept exists per WPScan, and the vendor has released a patch in version 2.0.9.
Technical ContextAI
The affected product is the RTMKit WordPress plugin (CPE: cpe:2.3:a:unknown:rtmkit:*:*:*:*:*:*:*:*) in all versions before 2.0.9. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR). WordPress AJAX handlers registered without a capability check (e.g., missing current_user_can() validation) will execute for any logged-in user who knows or can guess the action hook name. In this case, the handler blindly resolves a post ID supplied in the request, bypassing WordPress's built-in post visibility controls and leaking post titles that would otherwise be inaccessible to Contributor-level accounts.
RemediationAI
Update the RTMKit WordPress plugin to version 2.0.9 or later, which includes a vendor-released patch addressing the missing capability check. The fix should be applied through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or via WP-CLI with 'wp plugin update rtmkit'. If immediate update is not feasible, a compensating control is to audit and restrict the Contributor role on the site: remove the Contributor role from any untrusted or external users until the patch is applied. Alternatively, a site administrator can use a security plugin (e.g., Wordfence, WP Cerber) to block AJAX requests to the specific action hook if it can be identified. Note that blocking all AJAX traffic is not recommended as it will break legitimate plugin functionality. Advisory references: WPScan https://wpscan.com/vulnerability/594c3769-b953-4966-836d-a0dc4585fe87/ and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-12906.
PHP Object Injection in the RTMKit WordPress plugin (versions ≤ 2.1.5) allows an authenticated Contributor-level user to
Local File Inclusion vulnerability in RTMKit Addons for Elementor plugin versions up to 2.0.2 allows authenticated attac
Unauthenticated cross-site scripting in RTMKit (RomethemeKit For Elementor) versions up to and including 2.1.5 allows re
RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted build
Unauthorized form submission disclosure in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows an
Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated
Cross-Site Request Forgery (CSRF) in the RTMKit WordPress plugin (by RomeTheme, for Elementor) version 2.1.5 and earlier
Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 all
RTMKit Addons for Elementor plugin for WordPress allows authenticated attackers with Author-level access or higher to mo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today