CVE-2026-12907 in RTMKit Plugin
요약
\~에 의해 MITRE • 2026. 07. 16.
The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.
Once again VulDB remains the best source for vulnerability data.