CVE-2026-12907
Deferred Deferred - Pending Action

RTMKit WordPress Plugin Capability Bypass Leading to Template Override

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: WPScan

Description
The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-08-05
AI Q&A
2026-07-16
EPSS Evaluated
2026-08-04
NVD
CVE-2026-12907
EUVD
EUVD-2026-44880

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rtmkit wordpress_plugin to 2.0.9 (exc)
rtmkit addons_for_elementor to 2.0.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the RTMKit WordPress plugin (before version 2.0.9) allows users with at least the Author role to create and activate site-wide templates that override global design elements like headers or footers. Normally restricted to administrators, this is possible due to insufficient capability checks in an AJAX action.

Detection Guidance

Check the installed version of the RTMKit WordPress plugin or RTMKit Addons for Elementor plugin. If the version is below 2.0.9, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An attacker with Author-level access can inject unauthorized content into your site's header, footer, single post templates, or 404 pages. This could lead to defacement, malicious scripts, or unauthorized changes to the site's appearance for all visitors.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if unauthorized template changes lead to improper data handling or exposure. For example, if an attacker modifies a footer template to include malicious scripts or tracking, it might violate GDPR's data protection requirements or HIPAA's safeguarding rules for sensitive health information.

Mitigation Strategies

Update the RTMKit WordPress plugin or RTMKit Addons for Elementor plugin to version 2.0.9 or higher immediately. Remove unauthorized templates created by non-admin users and review user roles to ensure only administrators can modify global templates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart