CVE-2026-5137

RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter

2026-07-02 21:01
wesley (wcraft)

Strategic Overview

Status
Patched in 2.0.8
Affected Plugin
RTMKit
Affected Version
<= 2.0.7
CVSS
4.3Medium
Weakness type
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CVE
CVE-2026-5137
View all RTMKit vulnerabilities

At a glance

CVE-2026-5137 is a medium-severity Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in the RTMKit WordPress plugin, affecting versions <= 2.0.7. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Contributor level or above. The issue is fixed in version 2.0.8; sites on affected versions should update now. Disclosed July 2026, reported by wesley (wcraft).

Vulnerability Overview

The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

RTMKit <= 2.0.7 carries this weakness at template, and reaching it takes an account at Contributor level or above. PHP file inclusion means a path used by include or require is built from request data, so the file that gets executed is under the caller's influence.

Including an attacker-influenced file executes its contents, which is why this class is routinely chained with an upload or log-poisoning step to reach code execution. For RTMKit the fix is 2.0.8: builds <= 2.0.7 are affected, anything from 2.0.8 onward is not.

Remediation

Update to version 2.0.8, or a newer patched version

How does WordSec protect against this?

An attacker needs Contributor access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: RTMKit 2.0.8 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Scanner
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-5137https://www.wordfence.com/threat-intel/vulnerabilities/id/22172d16-bcde-4516-bce0-222fbb7a76f7https://nvd.nist.gov/vuln/detail/CVE-2026-5137

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C