Rtmkit
Monthly
RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted builder AJAX action without adequate capability verification, letting them create and activate site-wide templates that override globally displayed areas - headers, footers, and other layout regions - ordinarily controlled only by administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile) and CISA KEV does not list active exploitation, suggesting opportunistic rather than widespread abuse. The integrity impact is real but bounded: no data theft or remote code execution occurs, only unauthorized content modification visible to all site visitors.
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the Contributor role to enumerate private, draft, pending, scheduled, and trashed posts authored by other users. The root cause is a missing capability check in an AJAX handler that resolves a caller-supplied post identifier directly - a classic IDOR (CWE-639) pattern. No public exploit is in CISA KEV, but a publicly available proof-of-concept exists per WPScan, and the vendor has released a patch in version 2.0.9.
Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 allows authenticated attackers with Contributor-level access to include and execute arbitrary PHP code on the server. The render_templates AJAX endpoint passes the unsanitized 'template' parameter directly into a PHP require/include statement, restricted only to files ending in _templates.php. Wordfence reported this vulnerability; no public exploit code or CISA KEV listing is present at time of analysis.
Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated contributors to persist arbitrary JavaScript in WordPress pages via the Advanced Heading widget's 'Background Text' field. The root cause is the direct concatenation of the user-controlled `background_text_heading` setting into an HTML attribute inside the widget's `render()` function without applying WordPress's `esc_attr()` sanitization, reported by Wordfence. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, but the contributor-level access prerequisite makes this realistically exploitable on multi-author or open-registration WordPress sites.
Unauthorized form submission disclosure in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows any Contributor-level WordPress user to read arbitrary form submissions belonging to other users. The root cause is a missing capability check on the get_submission_content AJAX endpoint, enabling horizontal privilege escalation across all stored form entries by iterating numeric entry IDs. No public exploit or CISA KEV listing has been identified at time of analysis, but exploitation is mechanically trivial for any authenticated user; sites collecting sensitive PII or business data via RTMKit forms should treat this as high operational priority despite the medium CVSS score.
RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted builder AJAX action without adequate capability verification, letting them create and activate site-wide templates that override globally displayed areas - headers, footers, and other layout regions - ordinarily controlled only by administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile) and CISA KEV does not list active exploitation, suggesting opportunistic rather than widespread abuse. The integrity impact is real but bounded: no data theft or remote code execution occurs, only unauthorized content modification visible to all site visitors.
Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the Contributor role to enumerate private, draft, pending, scheduled, and trashed posts authored by other users. The root cause is a missing capability check in an AJAX handler that resolves a caller-supplied post identifier directly - a classic IDOR (CWE-639) pattern. No public exploit is in CISA KEV, but a publicly available proof-of-concept exists per WPScan, and the vendor has released a patch in version 2.0.9.
Local File Inclusion in the RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7 allows authenticated attackers with Contributor-level access to include and execute arbitrary PHP code on the server. The render_templates AJAX endpoint passes the unsanitized 'template' parameter directly into a PHP require/include statement, restricted only to files ending in _templates.php. Wordfence reported this vulnerability; no public exploit code or CISA KEV listing is present at time of analysis.
Stored Cross-Site Scripting in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows authenticated contributors to persist arbitrary JavaScript in WordPress pages via the Advanced Heading widget's 'Background Text' field. The root cause is the direct concatenation of the user-controlled `background_text_heading` setting into an HTML attribute inside the widget's `render()` function without applying WordPress's `esc_attr()` sanitization, reported by Wordfence. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, but the contributor-level access prerequisite makes this realistically exploitable on multi-author or open-registration WordPress sites.
Unauthorized form submission disclosure in RTMKit (rometheme-for-elementor) versions up to and including 2.0.7 allows any Contributor-level WordPress user to read arbitrary form submissions belonging to other users. The root cause is a missing capability check on the get_submission_content AJAX endpoint, enabling horizontal privilege escalation across all stored form entries by iterating numeric entry IDs. No public exploit or CISA KEV listing has been identified at time of analysis, but exploitation is mechanically trivial for any authenticated user; sites collecting sensitive PII or business data via RTMKit forms should treat this as high operational priority despite the medium CVSS score.