The RTMKit WordPress plugin contains a flaw where the get_submission_content AJAX endpoint does not verify that the user has permission to access a requested form submission. This missing authorization check allows an authenticated attacker with Contributor-level access or higher to submit an entries_id parameter and retrieve the content of any form submission stored by the site. The result is the disclosure of private form responses, a clear breach of confidentiality and a potential source of personal data exposure.

All WordPress sites that have installed Rometheme’s RTMKit plugin in any release up to and including 2.0.7 are affected. Any site hosting the plugin in these versions can be impacted by this authorization bypass.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation campaigns have been reported. Attackers must first have valid credentials with Contributor-level or higher privileges. The impact is confined to users who already possess these roles; however, if a site grants Contributor privileges broadly or if those accounts are compromised, the attack surface could increase. An exploit would involve crafting an authenticated AJAX request with a carefully chosen entries_id to enumerate other users’ submissions.