CVE-2025-62065criticalCWE-434

CVE-2025-62065: critical vulnerability in Rometheme RTMKit

WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability

Published · Updated

Follow this CVE+ Monitor RTMKit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 0.3%
In short

The RTMKit WordPress plugin allows attackers to upload malicious files without proper restrictions, potentially letting them take control of the website. This vulnerability affects versions up to 1.6.5.

Technical detail

CWE-434 unrestricted file upload vulnerability in RTMKit <= 1.6.5 allows unauthenticated or low-privileged attackers to upload arbitrary files with dangerous types, potentially leading to remote code execution or website compromise. The plugin fails to implement proper file type validation and restrictions on upload functionality.

Summary generated and translated by AI from the official description.
Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Rometheme · RTMKit
Related CVEs — Rometheme RTMKit

In the same product, most dangerous first.

CVE-2025-30911CRITICALWordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerabilityEPSS 1.9%CVE-2024-32956MEDIUMWordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-64283MEDIUMWordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2025-49235MEDIUMWordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24743MEDIUMWordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-47626MEDIUMWordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%