CVE-2026-3426mediumCWE-862

CVE-2026-3426: fallo de gravedad media en rometheme RTMKit

RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification

Publicada el

Seguir esta CVE+ Monitorear RTMKit

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.3%
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() and reset_all_widgets() functions in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with Author-level access and above, to modify or reset site-wide widget configurations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
rometheme · RTMKit
CVEs relacionadas — rometheme RTMKit

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-3425HIGHRTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'EPSS 0.6%CVE-2026-84752HIGHWordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-5137MEDIUMRTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' ParameterEPSS 0.4%CVE-2026-8351MEDIUMRTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' ParameterEPSS 0.4%CVE-2024-10326MEDIUMRomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgetsEPSS 0.4%CVE-2026-5149MEDIUMRTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' ParameterEPSS 0.3%