PT-2026-40594 · WordPress · Rtmkit Addons For Elementor

Momopon1415 · Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-3425

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RTMKit Addons for Elementor versions prior to 2.0.3

Description The plugin is susceptible to Local File Inclusion (LFI), a condition where an application includes files on a server without proper validation. Authenticated attackers with Author-level access or higher can exploit the 'get content' AJAX action through the path parameter to include and execute arbitrary PHP files. This may lead to the bypass of access controls, unauthorized access to sensitive data, or remote code execution if PHP files can be uploaded to the server.

Recommendations Update to a version later than 2.0.2. As a temporary workaround, restrict access to the 'get content' AJAX action or the path parameter for users with Author-level permissions.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-3425

Affected Products

Rtmkit Addons For Elementor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3425 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/396ecd5b-d351-4289-aea4-332af5101f10?source=cve · Note
• https://t.me/CVEtracker/53651 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3474369 · Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Core/PluginApi.php#L50 · Note