CVE-2026-5137: RTMKit WordPress Path Traversal Flaw

CVE-2026-5137 Overview

CVE-2026-5137 is a Local File Inclusion (LFI) vulnerability affecting the RTMKit (rometheme-for-elementor) plugin for WordPress. The flaw exists in versions up to and including 2.0.7 and stems from insufficient path validation on the template parameter within the render_templates AJAX endpoint. Authenticated attackers with Contributor-level access or above can include and execute server files ending in _templates.php, enabling execution of arbitrary PHP code contained in those files. The vulnerability is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Authenticated attackers with Contributor privileges can execute arbitrary PHP code by including files ending in _templates.php through the vulnerable render_templates AJAX endpoint.

Affected Products

RTMKit (rometheme-for-elementor) plugin for WordPress versions up to and including 2.0.7
WordPress installations using vulnerable versions of the plugin
Fixed in version 2.0.8

Discovery Timeline

2026-07-03 - CVE-2026-5137 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-5137

Vulnerability Analysis

The vulnerability resides in the TemplatekitAPI.php file within the Inc/Modules/Templatekits/ directory of the RTMKit plugin. The render_templates AJAX endpoint accepts a template parameter from the client and passes it directly to a PHP require/include statement without proper sanitization or validation. Because the value is user-controlled, an authenticated attacker can manipulate the path to point to files outside the intended template directory.

While the plugin appends _templates.php to the requested filename, this filter does not prevent path traversal sequences from resolving to files elsewhere on the filesystem. Any PHP code contained in a matching file will be executed within the WordPress application context. The EPSS score is 0.266% with a percentile of 18.049, reflecting relatively low observed exploitation activity to date.

Root Cause

The root cause is improper input validation on the template parameter used in a dynamic file inclusion. The affected code path performs no normalization, allowlist checks, or realpath validation before passing the parameter to a require or include statement. This design pattern is a canonical example of [CWE-98], where PHP file inclusion mechanisms operate on tainted input.

Attack Vector

Exploitation requires an authenticated WordPress account with Contributor-level access or higher. The attacker submits a crafted request to the render_templates AJAX endpoint with a manipulated template parameter that resolves to a file ending in _templates.php on the server. If such a file exists and contains PHP code, that code executes with the privileges of the web server process. The attack vector is network-based and does not require user interaction.

See the WordPress Plugin Code Reference for the vulnerable code path and the WordPress Commit Change for the applied fix.

Detection Methods for CVE-2026-5137

Indicators of Compromise

POST requests to admin-ajax.php with the action=render_templates parameter and unusual values in the template parameter, particularly containing ../ sequences or absolute paths.
Unexpected PHP execution or outbound network connections originating from the WordPress web server process shortly after Contributor-level authentication events.
Newly created or modified files ending in _templates.php outside the plugin's expected Templatekits directory.

Detection Strategies

Inspect web server access logs for AJAX requests targeting render_templates with suspicious template values.
Correlate WordPress authentication logs with subsequent AJAX activity from Contributor accounts to identify anomalous behavior.
Deploy static analysis or file integrity monitoring on the WordPress installation to flag unauthorized PHP file changes.

Monitoring Recommendations

Alert on any invocation of render_templates where the template parameter contains path traversal characters, null bytes, or absolute filesystem paths.
Monitor for elevated request volume from low-privilege WordPress accounts targeting AJAX endpoints.
Log and review all PHP include/require operations at the application or WAF layer where feasible.

How to Mitigate CVE-2026-5137

Immediate Actions Required

Update the RTMKit (rometheme-for-elementor) plugin to version 2.0.8 or later immediately.
Audit existing Contributor and higher-privilege WordPress accounts and remove any that are unused or unverified.
Review WordPress and web server logs for prior exploitation attempts against the render_templates endpoint.

Patch Information

The vendor released a fix in version 2.0.8. Review the WordPress Version Change Log and the Wordfence Vulnerability Report for full remediation details.

Workarounds

If patching is not immediately possible, deactivate the RTMKit plugin until the update is applied.
Restrict Contributor-level account creation and enforce strong authentication controls on all WordPress user accounts.
Deploy Web Application Firewall (WAF) rules to block requests to admin-ajax.php with the action=render_templates parameter containing path traversal sequences.

bash

# Example WAF rule (ModSecurity) blocking traversal in the template parameter
SecRule ARGS:action "@streq render_templates" \
    "chain,phase:2,deny,status:403,id:1026513701,msg:'CVE-2026-5137 LFI attempt'"
    SecRule ARGS:template "@rx (\.\./|\.\.\\|%2e%2e)" "t:lowercase,t:urlDecodeUni"