These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross Site Request Forgery (CSRF) vulnerability exists in RTMKit versions up to 2.1.5. This issue allows attackers to perform unintended actions on behalf of users. Defenders should assess exposure, particularly in systems using RTMKit. The vulnerability has a CVSS score of 5.4 and is considered medium severity.
The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7. This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data. This makes it possible for authenticated attackers, with Contributor-level access and above, to view arbitrary form submissi [truncated]