The RTMKit plugin for WordPress contains a Local File Inclusion flaw in the render_templates AJAX endpoint. When an attacker supplies an arbitrary value to the 'template' parameter, the plugin concatenates that value directly into a PHP require/include statement without any path validation. An authenticated user with Contributor or higher privileges can thus include and execute files ending in _templates.php on the server. This allows the execution of arbitrary PHP code, potentially yielding full control over the web server environment, classified as CWE‑98.

WordPress sites running the RTMKit plugin up to and including version 2.0.7 are affected. Any installation that uses these plugin versions is at risk, and abuse requires a user account granted Contributor or higher access rights.

The CVSS score of 4.3 corresponds to a moderate severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker first authenticates to the WordPress site with Contributor or higher privileges, so the overall risk is moderate to low in environments with strict role management. For organizations that have compromised contributor accounts or who allow many contributors, the threat heightens considerably.