CVE-2026-5149: RTMKit WordPress Auth Bypass Vulnerability

CVE-2026-5149 Overview

CVE-2026-5149 is an Incorrect Authorization vulnerability (CWE-863) in the RTMKit (Rometheme for Elementor) plugin for WordPress. The flaw exists in the get_submission_content AJAX endpoint, which fails to perform a capability check before returning form submission data. Authenticated attackers holding Contributor-level access or higher can iterate the entries_id parameter to read arbitrary form submissions belonging to other users. All plugin versions up to and including 2.0.7 are affected. The issue was fixed in version 2.0.8.

Critical Impact
Authenticated users with low privileges can exfiltrate confidential form submission data, including any personally identifiable information collected through Elementor forms built with RTMKit.

Affected Products

RTMKit (Rometheme for Elementor) plugin for WordPress, versions up to and including 2.0.7
WordPress sites exposing the get_submission_content AJAX endpoint
Sites using RTMKit submission modules to collect form data from visitors

Discovery Timeline

2026-06-16 - CVE-2026-5149 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-5149

Vulnerability Analysis

The RTMKit plugin exposes an AJAX action handled by the SubmissionModule class located at Inc/Modules/Submission/SubmissionModule.php. The get_submission_content callback retrieves stored form submissions based on the entries_id request parameter. The handler validates that the request originates from an authenticated user but does not verify whether that user has authorization to read the specific entry being requested.

Because WordPress assigns the Contributor role limited capabilities focused on draft authorship, contributors should never have access to other users' form data. The missing capability and ownership check breaks that boundary. Iterating sequential numeric values of entries_id allows an attacker to enumerate every submission stored by the plugin.

Root Cause

The vulnerability stems from a missing authorization check (CWE-863) in the AJAX handler. The endpoint relies on wp_ajax_ registration, which only confirms authentication, not authorization. No current_user_can() call or entry-ownership comparison is performed before submission content is serialized into the response. Lines 22 and 29 of SubmissionModule.php in the vulnerable build show the registration and handler logic that the changeset 3568335 modified to introduce a capability check.

Attack Vector

An attacker first obtains any account with Contributor privileges or higher. Many WordPress sites allow open registration or grant Contributor roles to guest authors, making this prerequisite low-friction. The attacker then issues authenticated POST requests to /wp-admin/admin-ajax.php with action=get_submission_content and an integer entries_id. Looping through identifiers returns stored submissions, including contact form contents, uploaded data, and any fields configured by the site owner. The vulnerability does not affect integrity or availability — only confidentiality of submission records.

For technical specifics, see the WordPress source reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-5149

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php with action=get_submission_content and incrementing entries_id values from a single authenticated session
Access log entries showing Contributor-level accounts invoking submission AJAX actions outside of normal editorial workflows
Unexpected outbound transfer of form submission data shortly after a new low-privileged account is created

Detection Strategies

Inspect WordPress access logs for high-frequency calls to admin-ajax.php?action=get_submission_content and correlate the requesting user_id with the role assigned to that account
Enable WordPress audit logging plugins to record AJAX actions invoked by non-administrator roles
Compare the count of distinct entries_id values queried per user against an expected baseline of zero for Contributor accounts

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and alert on enumeration patterns against admin-ajax.php
Track new user registrations and flag accounts that issue AJAX submission requests within a short time of provisioning
Monitor the installed version of the rometheme-for-elementor plugin across managed sites and alert when versions at or below 2.0.7 are detected

How to Mitigate CVE-2026-5149

Immediate Actions Required

Update the RTMKit (Rometheme for Elementor) plugin to version 2.0.8 or later on every WordPress site where it is installed
Audit existing user accounts and remove unused Contributor-level or higher accounts that were not explicitly authorized
Review form submission logs for unexpected access patterns before applying the patch

Patch Information

The vendor addressed the issue in version 2.0.8. The fix is documented in WordPress changeset 3568335 and the version diff between 2.0.7 and 2.0.8. The patch adds a capability check to the get_submission_content handler so only users with administrative form-management rights can retrieve submission content.

Workarounds

If immediate patching is not possible, deactivate the RTMKit plugin until the upgrade can be deployed
Restrict user registration on affected sites and require administrator approval for new Contributor accounts
Apply a Web Application Firewall rule that blocks unauthenticated and Contributor-role requests to admin-ajax.php with action=get_submission_content

bash

# Update the plugin via WP-CLI on affected hosts
wp plugin update rometheme-for-elementor --version=2.0.8

# Verify the installed version after upgrade
wp plugin get rometheme-for-elementor --field=version