Unauthorized Access Vulnerability in RTMKit WordPress Plugin
CVE-2026-12906
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-12906?
The RTMKit plugin for WordPress prior to version 2.0.9 is affected by an access control vulnerability. It fails to implement a necessary capability check for one of its AJAX actions, allowing users with just the Contributor role to exploit this flaw. This vulnerability enables them to gain unauthorized access to private, draft, pending, scheduled, and trashed posts belonging to other users. Consequently, this issue raises significant concerns about user data protection and privacy within the platform.
Affected Version(s)
RTMKit 0 < 2.0.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.