CVE-2026-3425: LFI in RTMKit Addons for Elementor

Successful exploitation of CVE-2026-3425 grants an attacker the ability to execute arbitrary PHP code on the server. This can lead to a complete compromise of the WordPress site, including data exfiltration, modification of website content, and installation of malicious software. The attacker, being authenticated with Author-level access, can leverage this vulnerability to bypass access controls and potentially escalate privileges. The blast radius extends to any sensitive data stored within the WordPress database or accessible through the web server’s file system. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to execute malicious code and gain control of the system.

1. Reservado2026-03-02
2. Publicada2026-05-12
3. Modificada2026-05-13

The primary mitigation for CVE-2026-3425 is to immediately upgrade the RTMKit Addons for Elementor plugin to version 2.0.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting file upload permissions within the WordPress environment to prevent attackers from uploading malicious PHP files that can be included. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious file paths or patterns in the 'path' parameter of the 'get_content' AJAX action. Thoroughly review and sanitize all user inputs to prevent malicious code injection.