The RTMKit Addons for Elementor plugin for WordPress contains a Local File Inclusion flaw (CWE-98) in the 'get_content' AJAX action, triggered via the 'path' parameter. An authenticated user with author-level or higher rights can specify any file path, causing the server to include and execute the target PHP file. This leads to full code execution on the server, permitting an attacker to bypass access controls, read sensitive data, or exfiltrate information when PHP files can be uploaded or otherwise accessed through the vulnerable path.

The vulnerability exists in all versions of RTMKit Addons for Elementor up to and including 2.0.2. It affects WordPress sites that have the plugin installed and are running within a standard WordPress environment.

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack requires authentication as an author or higher; once logged in, the attacker can craft a request to the vulnerable AJAX endpoint to include a malicious file. No publicly known exploits have been reported, but the absence of mitigation means a successful exploit would lead to code execution.