What is the CVSS score of CVE-2026-3425?

CVE-2026-3425 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of RTMKit Addons for Elementor are affected by CVE-2026-3425?

RTMKit Addons for Elementor (versions ≤2.0.2) contains a local file inclusion vulnerability allowing authenticated users with Author-level WordPress privileges to execute arbitrary PHP code,…

How to fix or mitigate CVE-2026-3425?

Within 24 hours: Audit WordPress user accounts with Author role or above on affected sites; document which users have legitimate need for this permission level. Within 7 days: Either disable RTMKit Addons for Elementor entirely, restrict it to Administrator-only use via file permissions, or deactivate the 'get_content' AJAX action if possible through plugin settings documentation. Within 30 days: Contact RTMKit developers for patch timeline; monitor vendor advisory channels weekly; evaluate alternative Elementor extensions without known vulnerabilities; prepare migration plan if patch unavailable within 90 days.

RTMKit Addons for Elementor CVE-2026-3425

EUVD-2026-29937 HIGH

PHP Remote File Inclusion (CWE-98)

2026-05-13 Wordfence

PHP LFI RCE WordPress Information Disclosure

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 13:16 vuln.today

CVE Published

May 13, 2026 - 12:29 nvd

HIGH 8.8

DescriptionCVE.org

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'get_content' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.

AnalysisAI

Local File Inclusion vulnerability in RTMKit Addons for Elementor plugin versions up to 2.0.2 allows authenticated attackers with Author-level privileges to include and execute arbitrary PHP files via the 'path' parameter in the 'get_content' AJAX action, enabling remote code execution. The vulnerability requires low-privilege WordPress account access (Author role or higher) and has a CVSS score of 8.8, indicating high impact across confidentiality, integrity, and availability. EPSS data not available, but exploitation requires specific WordPress role assignment, limiting attack surface to sites where untrusted users have Author-level access. No active exploitation confirmed by CISA KEV at time of analysis.

Technical ContextAI

This vulnerability affects the RTMKit Addons for Elementor WordPress plugin (CPE: cpe:2.3:a:rometheme:rtmkit), specifically the PluginApi.php file handling AJAX requests. The flaw is a classic CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) where the 'get_content' AJAX action accepts user-controlled input via the 'path' parameter without proper validation or sanitization. In WordPress environments, AJAX actions are exposed endpoints that authenticated users can invoke. The vulnerable code at line 50 of PluginApi.php likely uses PHP include(), require(), or similar file inclusion functions with the unsanitized 'path' parameter, allowing attackers to traverse the filesystem and include arbitrary PHP files. When PHP files are included, their code executes in the context of the web server process, granting full application-level access. This is particularly dangerous in WordPress environments where file upload capabilities combined with LFI create a complete remote code execution chain.

RemediationAI

Update RTMKit Addons for Elementor plugin to version 2.0.3 or later, which addresses the vulnerability per the WordPress plugin repository changeset 3474369 visible at https://plugins.trac.wordpress.org/changeset/3474369/. Review the changeset to confirm the exact fix version number before deployment. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: First, audit and restrict WordPress Author role assignments to only fully trusted users, understanding this may disrupt multi-author workflows and guest posting capabilities. Second, implement Web Application Firewall (WAF) rules to block requests to WordPress AJAX endpoints containing suspicious 'path' parameters with directory traversal sequences (../, absolute paths, or PHP file extensions), though this may cause false positives with legitimate plugin functionality. Third, use file integrity monitoring to detect unauthorized PHP file uploads and modifications, providing detection but not prevention. Fourth, disable PHP execution in WordPress upload directories via .htaccess or web server configuration (e.g., 'php_flag engine off' for Apache or 'location ~* ^/wp-content/uploads/.*\.php$ { deny all; }' for nginx), which prevents execution of uploaded PHP files but may break legitimate plugins requiring PHP execution in uploads. Review all existing Author-level accounts for signs of compromise. Consult the official Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/396ecd5b-d351-4289-aea4-332af5101f10?source=cve for additional guidance.