Executive brief
The RTMKit plugin for WordPress, which provides design elements for the Elementor page builder, contains a security flaw that allows users with low-level 'Contributor' access to view restricted information. An attacker with a basic account can bypass security checks to see the titles of private, draft, or deleted posts belonging to other users, as well as sensitive user account details. This could lead to the exposure of confidential internal information or upcoming content before it is officially published.
Technical details
The RTMKit Addons for Elementor plugin (versions prior to 2.0.9) is vulnerable to an Insecure Direct Object Reference (IDOR) within its AJAX handler for the 'get_specific_posts' action. The vulnerable component fails to implement a WordPress capability check (e.g., current_user_can), relying solely on a nonce that is accessible to any user with 'Contributor' permissions. By supplying a specific post identifier to the AJAX endpoint, an authenticated attacker can bypass standard visibility restrictions to retrieve the titles of private, draft, pending, scheduled, and trashed posts. Additionally, the 'post_type=author' parameter can be abused to enumerate site users. The issue is resolved in version 2.0.9.
Affected products
- Rometheme RTMKit Addons for Elementor < 2.0.9
Timeline
- 2026-06-25: disclosed: Vulnerability reported by researcher Meher Sudhakar Abbireddi
- 2026-06-25: patched: Version 2.0.9 released to address the issue
- 2026-07-16: advisory: CVE-2026-12906 published by WPScan and NVD