CVE-2026-5137: RTMKit WordPress Plugin Local File Inclusion Vulnerability

Technical summary

CVE-2026-5137 is a Local File Inclusion (LFI) vulnerability in RTMKit versions up to 2.0.7. The plugin's render_templates AJAX endpoint accepts a 'template' parameter that is passed directly to a require/include statement without path validation or sanitization. An authenticated attacker with Contributor-level privileges can exploit insufficient input filtering to include arbitrary files ending in _templates.php and execute embedded PHP code. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Business impact

Compromise of a WordPress site running a vulnerable RTMKit version could expose sensitive data, allow malware injection, deface the site, or enable lateral movement to other systems. The impact is limited by the requirement for pre-existing authenticated access, but Contributor roles are often assigned to authors, editors, and service vendors—significantly expanding the internal threat surface. Organizations relying on RTMKit for Elementor theme management should assess how many user accounts have Contributor access and whether those accounts are actively monitored.

Affected systems

RTMKit (rometheme-for-elementor) plugin for WordPress, versions 2.0.7 and earlier. The vulnerability requires the plugin to be installed and activated, and an attacker to possess a valid WordPress user account with Contributor role or above (Contributor, Editor, Administrator).

Exploitability

Exploitation requires authentication and Contributor-level access—a material barrier that reduces attack surface compared to unauthenticated remote code execution. However, this does not eliminate risk. Compromised or disgruntled staff, leaked credentials, or account takeovers can provide the necessary foothold. Exploitation is trivial once access is obtained (a simple parameter manipulation in an AJAX call), and there is no known evidence of active mass exploitation in the wild as of the CVE publication date.

Remediation

Update RTMKit to a patched version beyond 2.0.7. Administrators should verify the availability of a patched release from the plugin developer and deploy it to all affected WordPress instances. Until patching is complete, restrict Contributor-level access to trusted users only, monitor AJAX requests to the render_templates endpoint, and consider disabling the plugin if it is not actively in use.

Patch guidance

Check the RTMKit plugin repository or vendor advisory for a version higher than 2.0.7. Apply the update through the WordPress dashboard (Plugins > Installed Plugins > RTMKit > Update) or via command line (wp plugin update rtmkit) if using WP-CLI. Verify the update was applied successfully by confirming the new version number in the plugin details. Test the Elementor theme functionality in a staging environment before deploying to production.

Detection guidance

Monitor WordPress audit logs for AJAX requests to the render_templates endpoint, especially those originating from Contributor-level accounts. Look for suspicious 'template' parameter values that contain path traversal sequences (../, ..\.\, etc.) or references to files outside the expected template directory. Enable WordPress security logging via plugins such as Wordfence or Sucuri to track unauthorized file inclusion attempts. Network-level detection should flag unusual include/require activity from the wp-content/plugins/rtmkit directory.

Why prioritize this

Although the CVSS score of 4.3 (Medium) reflects the authentication requirement, this vulnerability warrants prioritization because: (1) Contributor access is often widely delegated in organizations; (2) exploitation is trivial and non-interactive once credentials are obtained; (3) successful exploitation leads to arbitrary code execution, a critical outcome; and (4) the plugin is not listed in active public exploit databases, meaning patching now prevents future weaponization.

Risk score, explained

The CVSS v3.1 score of 4.3 reflects a Medium severity due to the requirement for valid authentication and Contributor privileges (PR:L), which restricts attack vector to network access but limits scope. The integrity and availability impacts are rated as None; only confidentiality is slightly compromised (C:L) because the attacker can read file contents. However, the practical risk is higher because arbitrary PHP execution can escalate to full integrity and availability impact—use this score as a floor, not a ceiling.

Frequently asked questions