What is the CVSS score of CVE-2026-3426?

CVE-2026-3426 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

RTMKit Addons for Elementor CVE-2026-3426

EUVD-2026-29938 MEDIUM

Missing Authorization (CWE-862)

2026-05-13 Wordfence

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 13:17 vuln.today

CVE Published

May 13, 2026 - 12:29 nvd

MEDIUM 4.3

DescriptionCVE.org

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() and reset_all_widgets() functions in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with Author-level access and above, to modify or reset site-wide widget configurations.

AnalysisAI

RTMKit Addons for Elementor plugin for WordPress allows authenticated attackers with Author-level access or higher to modify or reset site-wide widget configurations due to missing capability checks in the save_widget() and reset_all_widgets() functions. This privilege escalation vulnerability affects all versions up to 2.0.2 and enables unauthorized modification of widget data across the entire WordPress site, impacting site integrity and user experience.

Technical ContextAI

RTMKit is an Elementor page builder addon that provides widget storage and configuration management through the WidgetStorage class. The vulnerability stems from missing WordPress capability checks (missing use of current_user_can() with appropriate admin capabilities like 'manage_options') on the save_widget() and reset_all_widgets() AJAX handlers. These functions process modifications to widget configurations stored in WordPress options without verifying that the requesting user has administrative privileges. CWE-862 (Missing Authorization) identifies the root cause - the absence of access control checks that should prevent lower-privileged roles (Author, Contributor) from performing administrative actions. The vulnerable code paths are exposed through AJAX endpoints in the WidgetStorage.php and EditorCanvas.php modules.

RemediationAI

Upgrade RTMKit Addons for Elementor to version 2.0.3 or later immediately. The patched version is available via the WordPress.org plugin repository and can be updated directly from the WordPress admin dashboard (Plugins > Installed Plugins > RTMKit Addons for Elementor > Update). If immediate upgrade is not possible, restrict Author-level user access to the Elementor editor as a temporary compensating control by using a role/capability management plugin (such as User Role Editor) to remove the 'edit_posts' or 'edit_pages' capability from Author roles, though this will limit legitimate editing workflows and should only be temporary. Verify that no unauthorized widget modifications were made during the vulnerability window by reviewing WordPress revision history and comparing current widget configurations against known baseline states.