Executive brief
RTMKit is a WordPress plugin used to enhance the Elementor page builder with additional design templates. A security flaw in this plugin allows users with basic contributor-level access to potentially execute unauthorized code or access sensitive files on the website's server. This could lead to a partial compromise of the site's data or server security.
Technical details
The RTMKit plugin for WordPress is vulnerable to Local File Inclusion (LFI) due to insufficient path validation on the 'template' parameter within the render_templates AJAX endpoint. This parameter is passed directly into a PHP require/include statement without proper sanitization. Authenticated attackers with Contributor-level permissions or higher can exploit this to include and execute any file on the server that ends with the '_templates.php' suffix. This vulnerability is classified under CWE-98. A fix is available in version 2.0.8.
Affected products
- rometheme RTMKit (rometheme-for-elementor) up to, and including, 2.0.7
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory
References
- https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.3/Inc/Modules/Templatekits/TemplatekitAPI.php
- https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php
- https://plugins.trac.wordpress.org/changeset/3568335/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/22172d16-bcde-4516-bce0-222fbb7a76f7?source=cve