RTMKit’s get_content AJAX action built a PHP include path from the user-supplied ‘path’ parameter and checked only a nonce that is also exposed in the Elementor editor, so any user with Author-level access or above could use ../ sequences to include and execute arbitrary PHP files on the server. This can expose sensitive data or lead to code execution. Affects versions up to and including 2.0.2; fixed in 2.0.3.
This vulnerability affects the following application versions:
- RTMKit 2.0.0
- RTMKit 2.0.2
- RTMKit 2.0.3