CVE-2026-5149 is an authorization bypass vulnerability in the RTMKit WordPress plugin caused by missing capability checks on the get_submission_content AJAX endpoint. This flaw allows authenticated users with Contributor-level privileges or above to access form submission data belonging to other users by iterating the entries_id parameter, exposing potentially sensitive information. The issue affects all versions up to and including 2.0.7. There is no vendor-provided patch or official remediation guidance available at this time.

An attacker with Contributor-level or higher access can view arbitrary form submissions from other users without proper authorization. This leads to a confidentiality breach of potentially sensitive form data. The vulnerability does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to form submissions. Avoid exposing sensitive data through form submissions accessible by this plugin.