Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-64283 EUVD-2025-36611GHSA-8cr2-hpc7-v23m

WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability

Published Oct 29, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RTMKit: from n/a through <= 1.6.7.

Affected products

VendorProductAffectedFixed
Rometheme RTMKit ≤ 1.6.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 rtkit No fix yet —

References