# CVE-2026-5137: rometheme RTMKit Local File Inclusion in render_templates AJAX endpoint

Source: https://junglewise.ai/threats/cve-2026-5137-rometheme-rtmkit-local-file-inclusion-in-render-templates-ajax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-5137 · Severity: medium · CVSS 4.3 · Published 2026-07-03

RTMKit is a WordPress plugin used to enhance the Elementor page builder with additional design templates. A security flaw in this plugin allows users with basic contributor-level access to potentially execute unauthorized code or access sensitive files on the website's server. This could lead to a partial compromise of the site's data or server security.

Technologies: [RomeTheme RTMKit](https://junglewise.ai/threats/technologies/rtmkit). Vendors: [RomeTheme](https://junglewise.ai/threats/vendors/rometheme).

## Quick answers

**Is CVE-2026-5137 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5137 being exploited in the wild.

**How severe is CVE-2026-5137?** Medium severity, with a CVSS score of 4.3, published 3 July 2026.

**Which products and versions are affected?** RomeTheme RTMKit up to, and including, 2.0.7.

**Is there a fix for CVE-2026-5137?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5137 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5137?** Check whether you run RomeTheme RTMKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The RTMKit plugin for WordPress is vulnerable to Local File Inclusion (LFI) due to insufficient path validation on the 'template' parameter within the render_templates AJAX endpoint. This parameter is passed directly into a PHP require/include statement without proper sanitization. Authenticated attackers with Contributor-level permissions or higher can exploit this to include and execute any file on the server that ends with the '_templates.php' suffix. This vulnerability is classified under CWE-98. A fix is available in version 2.0.8.

## Affected products

- rometheme RTMKit (rometheme-for-elementor) up to, and including, 2.0.7

## Timeline

- 2026-07-03: disclosed
- 2026-07-03: advisory

## References

- [https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.3/Inc/Modules/Templatekits/TemplatekitAPI.php](https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.3/Inc/Modules/Templatekits/TemplatekitAPI.php)
- [https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php](https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php)
- [https://plugins.trac.wordpress.org/changeset/3568335/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php](https://plugins.trac.wordpress.org/changeset/3568335/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php)
- [https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8](https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/22172d16-bcde-4516-bce0-222fbb7a76f7?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/22172d16-bcde-4516-bce0-222fbb7a76f7?source=cve)

## Related threats

- [RTMKit Cross-Site Request Forgery in subscriber actions](https://junglewise.ai/threats/cve-2026-62133-rtmkit-cross-site-request-forgery-in-subscriber-actions)
- [RTMKit cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2026-84763-rtmkit-cross-site-scripting-xss-vulnerability)
- [RTMKit PHP Object Injection](https://junglewise.ai/threats/cve-2026-84752-rtmkit-php-object-injection)
- [rometheme RTMKit Stored XSS in Advanced Heading widget](https://junglewise.ai/threats/cve-2026-8351-rometheme-rtmkit-stored-xss-in-advanced-heading-widget)
- [RomeTheme RTMKit incorrect authorization in get_submission_content](https://junglewise.ai/threats/cve-2026-5149-rometheme-rtmkit-incorrect-authorization-in-get-submission-content)