rometheme RTMKit Plugin up to 2.0.2 on WordPress get_content path php file inclusion

Summaryinfo

A vulnerability, which was classified as critical, has been found in rometheme RTMKit Plugin up to 2.0.2 on WordPress. Impacted is the function get_content. This manipulation of the argument path causes php file inclusion. This vulnerability is handled as CVE-2026-3425. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in rometheme RTMKit Plugin up to 2.0.2 on WordPress. Affected by this vulnerability is the function get_content. The manipulation of the argument path with an unknown input leads to a php file inclusion vulnerability. The CWE definition for the vulnerability is CWE-98. The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the 'get_content' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.

The weakness was released by momopon1415. It is possible to read the advisory at wordfence.com. This vulnerability is known as CVE-2026-3425 since 03/02/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/13/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• rometheme

Name

• RTMKit Plugin

Version

• 2.0.0
• 2.0.1
• 2.0.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion