PHP Object Injection Vulnerability in RTMKit Plugin for WordPress
CVE-2026-84752

8.8HIGH

Key Information:

Vendor

WordPress
Status
Rtmkit
Vendor
CVE Published:
3 September 2026

What is CVE-2026-84752?

The RTMKit Plugin for WordPress versions up to 2.1.5 is susceptible to PHP Object Injection, allowing attackers to exploit improperly handled input. This vulnerability can lead to severe security risks, including unauthorized actions and data exposure if users are not careful in managing plugin versions. Regular updates and oversight of user inputs are critical to safeguarding WordPress installations.

Affected Version(s)

RTMKit <= 2.1.5

References

https://patchstack.com/database/wordpress/plugin/romethem...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.