CVE-2026-12906
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The RTMKit WordPress plugin before version 2.0.9 fails to perform a capability check in one of its AJAX actions and directly resolves a request-supplied post identifier, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled, and trashed posts.
Risk Assessment
The risk involves information disclosure – low-privileged users can learn titles of unpublished or private content, compromising confidentiality and potentially leading to privilege escalation.
Recommendation
It is recommended to immediately update the RTMKit plugin to version 2.0.9 or later, which includes the necessary capability check.
Original NVD description (English source)
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.