Vulnerability · Published Jun 16, 2026 · Assigned by Wordfence

CVE-2026-5149RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter

Medium 6.5

In plain English

A medium-severity incorrect authorization in RTMKit from rometheme. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data. This makes it possible for authenticated attackers, with Contributor-level access and above, to view arbitrary form submissions from other users by iterating the entries_id parameter.

Affected products (as reported)

Vendor	Product	Versions
rometheme	RTMKit	0 – through 2.0.7

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References