CVE-2026-5137
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The RTMKit (rometheme-for-elementor) plugin for WordPress up to version 2.0.7 is vulnerable to Local File Inclusion (LFI). This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This allows authenticated attackers with Contributor-level access and above to include and execute files on the server ending in _templates.php, enabling the execution of any PHP code in those files.
Risk Assessment
The risk for the organization is that an attacker with Contributor-level or higher privileges can execute arbitrary PHP code from _templates.php files on the server, potentially leading to full compromise of the WordPress site, data theft, or further attack escalation.
Recommendation
Immediately update the RTMKit plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin or restrict access to the render_templates endpoint for unauthorized users.
Other vulnerabilities in RTMKit
See all- CVE-2026-12907Low
The RTMKit WordPress plugin before version 2.0.9 fails to perform a proper capability check on one of its builder AJAX actions. Users with at least the Author role can create and activate a site-wide template that overrides the header, footer, or other global areas displayed to all visitors, which is normally restricted to administrators.
- CVE-2026-12906Low
The RTMKit WordPress plugin before version 2.0.9 fails to perform a capability check in one of its AJAX actions and directly resolves a request-supplied post identifier, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled, and trashed posts.
- CVE-2026-8351Medium
The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.
Original NVD description (English source)
The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files.