CVE-2026-12907 - RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation · CoreCVE

Back Back to CVE browser

LOW

RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation

Published Jul 16, 2026

2.7

LOW

CVSS 3.1

EPSS 0.28%

Description

The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.

Affected products

Vendor n/a Product RTMKit Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.0.9

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

RTMKit

unaffected

Version	Status	Constraints
0	affected	<2.0.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (1)

https://wpscan.com/vulnerability/61588303-d356-4cec-9cdc-15dc8cb0b29f/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/61588303-d356-4cec-9cdc-15dc8cb0b29f/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jul 16, 2026

Updated Jul 16, 2026

Reserved Jun 22, 2026

Link CVE-2026-12907

CISA Vulnrichment

Updated Jul 16, 2026

Status Deferred

Modified Jul 16, 2026

Link CVE-2026-12907

Severity n/a

Public date n/a

Links CVE-2026-12907