CVE-2026-5149

Name of the Vulnerable Software and Affected Versions RTMKit versions prior to 2.0.8

Description The RTMKit plugin for WordPress contains an incorrect authorization flaw. The 'get submission content' AJAX endpoint does not perform a capability check to verify if a user is authorized to access specific form submission data. Consequently, authenticated attackers with Contributor-level access or higher can view arbitrary form submissions from other users by iterating the entries id parameter.

Recommendations Update to a version newer than 2.0.7. As a temporary workaround, restrict access to the 'get submission content' AJAX endpoint or limit user permissions to prevent Contributor-level accounts from accessing form submission data.