CVE-2026-5149: RTMKit WordPress Plugin Authorization Bypass – Form Data Exposure

Technical summary

The get_submission_content AJAX endpoint in RTMKit fails to implement capability checks before returning form submission data. The vulnerability stems from insufficient authorization controls (CWE-863: Incorrect Authorization) on a parameter-driven query. An authenticated user at the Contributor role or above can enumerate the entries_id parameter and retrieve submission records across the entire form dataset, bypassing intended data isolation boundaries. The attack requires only network access and valid WordPress authentication; no user interaction or special conditions are needed.

Business impact

Organizations relying on RTMKit for form collection and lead capture face exposure of confidential submission data—potentially including customer inquiries, sensitive contact details, or business-critical information captured via web forms. A compromised or malicious contributor account, or an insider threat, can systematically exfiltrate all form responses without leaving obvious traces. This undermines data privacy commitments, may trigger compliance violations (GDPR, CCPA), and damages user trust in data handling practices.

Affected systems

All WordPress installations using the RTMKit plugin in version 2.0.7 or earlier are vulnerable. The plugin is accessible in WordPress repositories and likely used by small to mid-sized organizations managing contact, registration, or survey forms. Any site that relies on form submissions for lead generation, customer communication, or data collection faces risk if the plugin is active and accessible to accounts at the Contributor level or above.

Exploitability

Exploitability is straightforward for any authenticated user with Contributor role permissions or higher. No complex attack chain, user interaction, or technical knowledge is required—simple iteration of submission IDs in a web request reveals sensitive data. The barrier to exploitation is low; the primary requirement is obtaining valid WordPress credentials at a sufficient privilege level. This makes the vulnerability particularly risky in multi-author or agency WordPress environments where contributor access is commonly distributed.

Remediation

Update the RTMKit plugin to a patched version that implements proper capability checks on the get_submission_content AJAX endpoint. Verify the specific patch version against the vendor advisory. Until patching is complete, restrict Contributor-level and above roles to trusted users only, and consider disabling form functionality if the plugin cannot be updated immediately. Review access logs and audit who has accessed the AJAX endpoint to identify potential data exposure.

Patch guidance

Check the RTMKit plugin page and vendor advisory for the first patched version following 2.0.7. Apply the update through the WordPress admin dashboard (Plugins → Updates) or manually via SFTP if auto-updates are not enabled. Test the update in a staging environment first, particularly if custom code or extensions depend on the plugin. After patching, verify that the get_submission_content endpoint now enforces capability checks by attempting access from a low-privilege test account.

Detection guidance

Monitor WordPress logs and server access logs for repeated or suspicious requests to the get_submission_content AJAX action with varying entries_id parameters. Look for patterns indicating enumeration (sequential or high-frequency ID requests from the same IP/user). Query WordPress user activity logs to identify which Contributor+ accounts have accessed form submissions they should not have permission to view. Database queries may reveal unauthorized reads of form submission records correlated with specific user sessions.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the practical risk is elevated in multi-user WordPress environments. The vulnerability requires only basic authentication and poses a direct, low-friction path to sensitive data exfiltration. Organizations should prioritize patching this within their standard update windows, especially if forms collect PII, customer data, or proprietary information. Not currently in the KEV catalog, but the ease of exploitation and privacy implications warrant prompt remediation.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the combination of network exploitability (AV:N), low attack complexity (AC:L), requirement for low privileges (PR:L), and high confidentiality impact (C:H) with no integrity or availability impact. The score appropriately captures the severity of unauthorized data disclosure; however, organizational risk may be higher in environments where form data is particularly sensitive or compliance-critical.

Frequently asked questions