CVE-2026-12906 - RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure

CVE ID :CVE-2026-12906 Published : July 16, 2026, 6 a. m. | 58 minutes ago Description :The RTMKit WordPress plugin before 2.

0. 9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts. Severity: 0.

0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more.