Rt Theme 18 Extensions CVE-2026-39711

The vulnerability requires that the WordPress site using RT-Theme 18 Extensions plugin (versions 0-2.5) is publicly accessible and that the plugin is actively processing requests or rendering pages that include sensitive data in outbound responses. No special configuration or feature enablement is explicitly stated in available sources; however, the information disclosure depends on the plugin transmitting or embedding sensitive values in client-facing responses where they can be observed or extracted.

The risk profile shows a significant mismatch between CVSS and real-world exploitability. CVSS 5.3 with AV:N/AC:L/PR:N/UI:N/S:U/C:L indicates remote unauthenticated exploitation with low complexity, but the EPSS score of 0.02% (5th percentile) strongly suggests this vulnerability has minimal exploitation probability in practice. This discrepancy likely reflects that while the vulnerability is technically exploitable, it requires specific knowledge of the plugin's data transmission patterns or relies on passive observation of network traffic. No evidence of public exploit code (POC) or active exploitation (KEV status) was identified, further supporting that this is a low-priority information disclosure rather than an attractive target for threat actors.

An attacker inspects HTTP responses from a WordPress site running the vulnerable RT-Theme 18 Extensions plugin and identifies sensitive data (such as API keys, user identifiers, configuration paths, or internal references) embedded in HTML, JavaScript, or API responses without proper encoding. The attacker can passively observe this data through network sniffing on shared networks, or actively request pages known to trigger plugin functionality, extracting the exposed information without authentication or user interaction.