CVE-2026-5137

Name of the Vulnerable Software and Affected Versions RTMKit versions prior to 2.0.8

Description The RTMKit (rometheme-for-elementor) plugin for WordPress contains a Local File Inclusion flaw. This occurs because the render templates AJAX endpoint does not properly validate the template parameter before using it in a require/include statement. Authenticated users with Contributor-level access or higher can exploit this to include and execute any server files ending in templates.php, leading to the execution of arbitrary PHP code.

Recommendations Update the plugin to a version newer than 2.0.7. As a temporary mitigation, restrict access to the render templates AJAX endpoint or limit user permissions to prevent Contributor-level users from accessing the affected functionality.