CVE-2026-5137

The record

The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files.

Affected packages

Related vulnerabilities

• CVE-2026-87927 MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and… CWE-98
• CVE-2026-15406 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin… CWE-98
• CVE-2026-15667 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin… CWE-98
• CVE-2026-11613 The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all… CWE-98
• CVE-2026-28150 Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. CWE-98
• CVE-2026-66586 Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions. CWE-98
• CVE-2026-75963 The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all… CWE-98
• CVE-2026-73387 Unauthenticated Local File Inclusion in Resido <= 1.5 versions. CWE-98