CVE-2026-12907
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The RTMKit WordPress plugin before version 2.0.9 fails to perform a proper capability check on one of its builder AJAX actions. Users with at least the Author role can create and activate a site-wide template that overrides the header, footer, or other global areas displayed to all visitors, which is normally restricted to administrators.
Risk Assessment
The risk is that unauthorized users (Authors) can modify the global appearance of the site, potentially leading to defacement, injection of malicious content, or compromise of visual integrity, affecting all visitors.
Recommendation
Immediately update the RTMKit plugin to version 2.0.9 or later. If an update is not possible, temporarily disable the plugin or restrict access to its functionality via access control rules.
Original NVD description (English source)
The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.