PT-2026-49613 · WordPress · Rtmkit

Wesley · CVE-2026-5149 · Published 2026-06-16 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RTMKit versions prior to 2.0.8

Description The RTMKit plugin for WordPress contains an incorrect authorization flaw. The 'get submission content' AJAX endpoint does not perform a capability check to verify if a user is authorized to access specific form submission data. Consequently, authenticated attackers with Contributor-level access or higher can view arbitrary form submissions from other users by iterating the entries id parameter.

Recommendations Update to a version newer than 2.0.7. As a temporary workaround, restrict access to the 'get submission content' AJAX endpoint or limit user permissions to prevent Contributor-level accounts from accessing form submission data.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-5149

Affected Products

Rtmkit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-5149 · Security Note
• https://twitter.com/VulmonFeeds/status/2066782309668254187 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1fe363b2-8c70-45cd-9fdc-8979f894efd8?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8 · Note
• https://plugins.trac.wordpress.org/changeset/3568335/rometheme-for-elementor/trunk/Inc/Modules/Submission/SubmissionModule.php · Note
• https://t.me/CVEtracker/56944 · Telegram Post
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Modules/Submission/SubmissionModule.php#L22 · Note
• https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Modules/Submission/SubmissionModule.php#L29 · Note