CVE-2026-5137
Received Received - Intake

Local File Inclusion in RTMKit WordPress Plugin

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Wordfence

Description
The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-03
Last Modified
2026-07-03
Generated
2026-07-03
AI Q&A
2026-07-03
EPSS Evaluated
N/A
NVD
CVE-2026-5137
EUVD
EUVD-2026-41528

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rometheme rometheme-for-elementor to 2.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The RTMKit (rometheme-for-elementor) plugin for WordPress has a Local File Inclusion vulnerability in versions up to and including 2.0.7. This occurs because the 'template' parameter in the render_templates AJAX endpoint is not properly validated. The parameter is used directly in a require/include statement without sanitization, which allows authenticated users with Contributor-level access or higher to include and execute files on the server that end with _templates.php.

Impact Analysis

This vulnerability allows attackers with Contributor-level access or above to execute arbitrary PHP code on the server by including files ending with _templates.php. This can lead to unauthorized code execution, potentially compromising the server, altering website behavior, or exposing sensitive data.

Mitigation Strategies

To mitigate this vulnerability, you should update the RTMKit (rometheme-for-elementor) plugin to a version later than 2.0.7 where the issue is fixed.

Additionally, restrict Contributor-level and higher user permissions carefully, as the vulnerability requires authenticated users with at least Contributor access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart