An unrestricted file upload flaw exists in the Rometheme RTMKit plugin for WordPress, allowing an attacker to upload any file type, including executable code. The vulnerability is classified as CWE‑434. If exploited, the attacker could upload a malicious script or other executable payload, potentially enabling remote code execution, defacement, or data exfiltration.

The flaw affects the Rometheme RTMKit plugin for the WordPress platform, with all releases through 1.6.5 (and earlier). Current users of any version 1.6.5 or below are vulnerable until the plugin is updated.

The CVSS base score is 9.9, reflecting a high likelihood of remote code execution with high impact on confidentiality, integrity, and availability. The EPSS score is less than 1 %, indicating relatively low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would likely leverage the WordPress administrative interface or publicly accessible upload forms to deliver a malicious file; no additional authentication or privilege escalation is required beyond accessing the plugin’s upload function.