RTMKit WordPress Plugin CVE-2026-5137

Exploitation requires a WordPress user account with at minimum Contributor-level access - this is the explicit prerequisite stated in the description and corroborated by the CVSS PR:L metric. The render_templates AJAX endpoint must be reachable (standard WordPress AJAX path). For information disclosure, no additional conditions are needed beyond authentication: the attacker can attempt to include any file on the server whose path ends in _templates.php. For arbitrary PHP code execution, a file matching that suffix containing attacker-influenced PHP must already exist on the server's filesystem (e.g., a previously uploaded file, a plugin asset, or another writable path). Exploitation is limited to files ending in _templates.php, which materially constrains the code execution path. There is no user interaction required beyond the attacker's own AJAX request.

The official CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates only confidentiality impact, which understates the vulnerability's true ceiling. The CVE description explicitly states execution of arbitrary PHP code is possible, which implies potential integrity and availability impact under the right conditions - a discrepancy that defenders should note. The authentication requirement (Contributor-level) is a genuine limiting factor in most WordPress deployments where open registration is disabled, but in membership sites, editorial platforms, or sites with contributor self-registration this threshold is easily met. No EPSS data was provided in the intelligence package; no KEV listing exists, indicating no confirmed in-the-wild exploitation. The _templates.php suffix constraint increases the attack complexity for code execution specifically: the attacker must either identify an existing file matching the pattern with controllable content, or have a secondary upload primitive. For information disclosure alone, complexity is low. Overall, real-world risk is moderate for multi-author or open-registration WordPress deployments and low for single-author or tightly access-controlled sites.

An attacker with a valid WordPress Contributor account crafts a POST request to the site's AJAX handler (wp-admin/admin-ajax.php) targeting the render_templates action, supplying a manipulated 'template' parameter using path traversal sequences to point to a PHP file ending in _templates.php that contains attacker-controlled code - such as one previously uploaded via a media or theme upload primitive. The server-side include executes the PHP payload within the web server's process context, enabling command execution or data exfiltration. No public proof-of-concept code has been identified at time of analysis.