CVE-2026-5149 is an incorrect authorization vulnerability (CWE-863) in the RTMKit WordPress plugin affecting versions up to 2.0.7. The get_submission_content AJAX endpoint lacks proper capability checks, allowing authenticated users with Contributor-level privileges or above to access form submissions of other users by iterating the entries_id parameter. This flaw enables unauthorized disclosure of sensitive form submission data without requiring elevated privileges beyond Contributor access.

Authenticated attackers with Contributor-level access or higher can view arbitrary form submissions submitted by other users. This leads to unauthorized disclosure of potentially sensitive data contained in those form submissions. The vulnerability does not affect integrity or availability but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the RTMKit plugin if sensitive form data exposure is a concern.