First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-84752

HighCVSS 8.8/10Last modified Sep 3, 2026

Description

Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
rometheme	RTMKit	<= 2.1.5

References

https://patchstack.com/database/wordpress/plugin/rometheme-for-elementor/vulnerability/wordpress-rtmkit-plugin-2-1-5-php-object-injection-vulnerability?_s_id=cve

Timeline

Published: Sep 3, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-847539.8Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-847546.5Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.CVE-2026-847556.5Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.CVE-2026-847567.1Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.CVE-2026-847578.2Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.CVE-2026-847586.5Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.CVE-2026-847597.1Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.CVE-2026-84769.9IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncD CVE-2026-847605.3Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.CVE-2026-847617.2Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.CVE-2026-847625.3Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.CVE-2026-847637.1Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

CVE-2026-84752: High severity, CVSS 8.8 | Vulnix