CVE-2026-3425: LFI in RTMKit Addons for Elementor

The impact of this LFI vulnerability is significant. An attacker, once authenticated, can leverage the 'get_content' AJAX action's 'path' parameter to include and execute arbitrary PHP files. This effectively grants them the ability to execute arbitrary code on the server, potentially bypassing access controls. Successful exploitation could lead to the theft of sensitive data, modification of website content, or even complete system compromise. The ability to upload and include PHP files amplifies the risk, allowing attackers to inject malicious code directly into the environment. This vulnerability shares similarities with other LFI exploits where attackers gain code execution by manipulating file paths.

1. Reserviert2026-03-02
2. Veröffentlicht2026-05-12
3. Geändert2026-05-13

The primary mitigation for CVE-2026-3425 is to immediately upgrade the RTMKit Addons for Elementor plugin to version 2.0.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the 'get_content' AJAX action. Implement a Web Application Firewall (WAF) rule to filter requests containing suspicious characters or patterns in the 'path' parameter. Regularly review file permissions to ensure that only authorized users have write access to PHP files. After upgrading, confirm the fix by attempting to access the vulnerable endpoint with a malicious path; the request should be denied.