EUVD-2026-44880
GHSA-q754-gwx4-mxg2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Author role maps to PR:L, not PR:H; no confidentiality or availability impact, only low integrity via unauthorized template activation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.
AnalysisAI
RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted builder AJAX action without adequate capability verification, letting them create and activate site-wide templates that override globally displayed areas - headers, footers, and other layout regions - ordinarily controlled only by administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile) and CISA KEV does not list active exploitation, suggesting opportunistic rather than widespread abuse. The integrity impact is real but bounded: no data theft or remote code execution occurs, only unauthorized content modification visible to all site visitors.
Technical ContextAI
The vulnerability stems from CWE-862 (Missing Authorization) in RTMKit's WordPress AJAX handler. WordPress AJAX actions registered via wp_ajax_ hooks must explicitly verify user capabilities using current_user_can() before executing privileged operations; RTMKit's builder action omits this check. The affected CPE is cpe:2.3:a:unknown:rtmkit:*:*:*:*:*:*:*:* covering all versions before 2.0.9. The 'Author' WordPress role (above Subscriber and Contributor, below Editor and Administrator) is the minimum privilege level required, meaning any registered content creator on a multi-author site can exploit this. The flaw specifically targets the template activation pathway - a capability normally reserved for administrators managing global site layout.
RemediationAI
Update RTMKit to version 2.0.9 or later, which implements proper capability checks on the builder AJAX action. Patch availability is confirmed by the vendor per WPScan advisory at https://wpscan.com/vulnerability/61588303-d356-4cec-9cdc-15dc8cb0b29f/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-12907. If immediate upgrade is not feasible, restrict the Author role to trusted users only, as the vulnerability requires an authenticated account at that privilege level or above. As a compensating control, administrators can audit and restrict AJAX endpoint access via a Web Application Firewall rule targeting the specific builder action slug, though this may break legitimate plugin functionality. Deactivating the plugin entirely eliminates risk with the obvious trade-off of losing its builder features.
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the
Unauthorized form submission disclosure in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows an
Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated
Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 all
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today