CVE-2026-12906
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The RTMKit WordPress plugin before version 2.0.9 fails to perform a capability check in one of its AJAX actions and directly resolves a request-supplied post identifier, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled, and trashed posts.
Risk Assessment
The risk involves information disclosure – low-privileged users can learn titles of unpublished or private content, compromising confidentiality and potentially leading to privilege escalation.
Recommendation
It is recommended to immediately update the RTMKit plugin to version 2.0.9 or later, which includes the necessary capability check.
Other vulnerabilities in RTMKit
See all- CVE-2026-62133Medium
The RTMKit plugin in versions up to and including 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF). A user with the Subscriber role can be tricked into performing unwanted actions.
- CVE-2026-84763High
Unauthenticated Cross Site Scripting (XSS) in RTMKit versions up to 2.1.5. An attacker can inject malicious script without authentication.
- CVE-2026-84752High
Contributor PHP Object Injection in RTMKit versions up to 2.1.5. A user with contributor role can inject malicious PHP objects.
- CVE-2026-12907Low
The RTMKit WordPress plugin before version 2.0.9 fails to perform a proper capability check on one of its builder AJAX actions. Users with at least the Author role can create and activate a site-wide template that overrides the header, footer, or other global areas displayed to all visitors, which is normally restricted to administrators.
- CVE-2026-5137Medium
The RTMKit (rometheme-for-elementor) plugin for WordPress up to version 2.0.7 is vulnerable to Local File Inclusion (LFI). This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This allows authenticated attackers with Contributor-level access and above to include and execute files on the server ending in _templates.php, enabling the execution of any PHP code in those files.
- CVE-2026-8351Medium
The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.
Original NVD description (English source)
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS