The RTMKit WordPress plugin before version 2.0.9 fails to properly verify user capabilities on a specific builder AJAX action. This flaw permits users with Author-level privileges to create and activate templates that affect the entire site’s global display areas, including header and footer sections. Such actions should be limited to administrators, but the missing authorization check enables privilege escalation within the plugin's functionality.

Users with the Author role can escalate their influence by creating and activating site-wide templates that override global UI components visible to all visitors. This could lead to unauthorized content display modifications, potentially impacting site integrity and user trust. However, the vulnerability does not allow arbitrary code execution or full administrative control beyond template activation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author role capabilities or disable the vulnerable AJAX builder actions if possible. Monitor vendor channels for updates and apply any released patches promptly.