What is the CVSS score of CVE-2026-5137?

CVE-2026-5137 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

RTMKit WordPress Plugin CVE-2026-5137

EUVD-2026-41528 MEDIUM

PHP Remote File Inclusion (CWE-98)

2026-07-03 Wordfence

GHSA-9g8c-cjxj-24g2

WordPress LFI Information Disclosure PHP Rtmkit

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects required Contributor auth; I:L added because description explicitly states PHP code execution is possible under reachable conditions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 10:21 vuln.today

CVE Published

Jul 03, 2026 - 09:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files.

AnalysisAI

Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 allows authenticated attackers with Contributor-level access to include and execute arbitrary PHP code on the server. The render_templates AJAX endpoint passes the unsanitized 'template' parameter directly into a PHP require/include statement, restricted only to files ending in _templates.php. Wordfence reported this vulnerability; no public exploit code or CISA KEV listing is present at time of analysis.

Technical ContextAI

The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP file inclusion vulnerability. The vulnerable code resides in Inc/Modules/Templatekits/TemplatekitAPI.php at line 39, where the 'template' parameter received from the AJAX request is consumed by a PHP require/include call without path sanitization or allowlist validation. The CPE identifier cpe:2.3:a:rometheme:rtmkit:*:*:*:*:*:*:*:* confirms the affected software is the RTMKit plugin by RomeTheme, an Elementor page builder addon for WordPress. The suffix restriction (_templates.php) narrows the attack surface compared to unconstrained LFI but does not eliminate code execution risk if attacker-influenced files matching that pattern exist on the server through prior upload or existing plugin assets.

RemediationAI

Upgrade the RTMKit plugin to version 2.0.8, which is the patched release inferred from the WordPress SVN changeset comparing the 2.0.7 and 2.0.8 tags (https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8). The fix modifies TemplatekitAPI.php to properly sanitize or validate the 'template' parameter before it is passed to the include statement. If an immediate upgrade is not possible, restrict WordPress user registration to prevent Contributor-level account creation, or disable the Templatekit AJAX endpoint functionality via a WAF rule blocking requests to the render_templates AJAX action. Note that restricting registration is a partial mitigation only - existing Contributor accounts would still be able to exploit the endpoint.