CVE-2024-10326 is a missing authorization vulnerability (CWE-862) in the RomethemeKit For Elementor WordPress plugin (RTMKit). The issue arises from the absence of capability checks on the save_options and reset_widgets functions in all versions up to and including 1.5.3. This flaw enables authenticated attackers with Subscriber-level privileges or higher to modify plugin configuration or reset widgets to default states without proper authorization. The vulnerability was only partially addressed in version 1.5.3, and no complete patch is currently confirmed. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and limited impact on integrity without affecting confidentiality or availability.

Authenticated users with low privileges (Subscriber-level and above) can modify plugin settings or reset widgets without proper authorization. This can lead to unauthorized changes in the plugin's behavior or appearance but does not impact data confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Version 1.5.3 includes a partial fix, but a complete resolution is not confirmed. Until an official patch is released, restrict Subscriber-level access where possible and monitor plugin updates from the vendor for a full fix.