CVE-2026-3426mediumCWE-862

CVE-2026-3426: medium-severity vulnerability in rometheme RTMKit

RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification

Published

Follow this CVE+ Monitor RTMKit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.3%
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() and reset_all_widgets() functions in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with Author-level access and above, to modify or reset site-wide widget configurations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
rometheme · RTMKit
Related CVEs — rometheme RTMKit

In the same product, most dangerous first.

CVE-2026-3425HIGHRTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'EPSS 0.6%CVE-2026-84752HIGHWordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-5137MEDIUMRTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' ParameterEPSS 0.4%CVE-2026-8351MEDIUMRTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' ParameterEPSS 0.4%CVE-2024-10326MEDIUMRomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgetsEPSS 0.4%CVE-2026-5149MEDIUMRTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' ParameterEPSS 0.3%