Attack Chain

1. An attacker authenticates to the WordPress site with Author-level or higher privileges.
2. The attacker crafts a malicious HTTP request targeting the ‘admin-ajax.php’ endpoint.
3. The request includes the ‘action’ parameter set to ‘get_content’.
4. The attacker manipulates the ‘path’ parameter within the request, setting it to point to a sensitive local file or an uploaded PHP file.
5. The server processes the request and includes the specified file.
6. If the included file is a PHP file, the server executes the PHP code.
7. The attacker can leverage this to read sensitive data from the server, such as configuration files.
8. Alternatively, the attacker could upload a PHP file (e.g., through a separate vulnerability or misconfiguration) and then include it using the LFI vulnerability, achieving arbitrary code execution.

Impact

Successful exploitation of CVE-2026-3425 allows attackers with Author-level access to bypass access controls and execute arbitrary PHP code on the WordPress server. This could lead to the compromise of sensitive data, defacement of the website, or complete takeover of the server. The number of potentially affected websites is significant, given the widespread use of WordPress and the RTMKit Addons for Elementor plugin.

Recommendation

• Upgrade the RTMKit Addons for Elementor plugin to a version greater than 2.0.2 to patch CVE-2026-3425.
• Deploy the Sigma rule “Detect CVE-2026-3425 Exploitation — RTMKit LFI Attempt” to your SIEM and tune for your environment.
• Monitor web server logs for requests to ‘admin-ajax.php’ with the ‘action’ parameter set to ‘get_content’ and suspicious values in the ‘path’ parameter, using the file paths and extensions in the detection rule as a reference.