CVE-2026-12907

The RTMKit WordPress plugin (specifically RTMKit Addons for Elementor ) versions before 2.0.9 is vulnerable to an authorization bypass. The root cause is a missing capability check on one of its -builder AJAX actions . This flaw allows users with at least the Author role to create and activate si...