Unauthorized Data Modification in RTMKit Addons for Elementor Plugin by Rometheme

CVE-2026-3426

What is CVE-2026-3426?

The RTMKit Addons for Elementor plugin for WordPress suffers from a security gap that allows authenticated attackers with Author-level access or higher to manipulate site-wide widget settings. The vulnerability arises from the absence of essential capability checks in the save_widget() and reset_all_widgets() functions. This flaw could potentially enable malicious users to alter important configurations without proper permission, leading to unauthorized changes across the website.

References