The Rometheme RTMKit plugin contains a critical unrestricted file upload vulnerability that allows attackers to achieve remote code execution on the host server.

The plugin fails to properly validate file types during the upload process. An unauthenticated attacker can exploit this to upload arbitrary files, such as malicious scripts, which can then be executed on the server.

With a CVSS score of 9.9, this vulnerability represents an extreme risk to the entire web environment. Successful exploitation allows full server compromise, potential data exfiltration, and the ability for attackers to establish persistence, leading to severe reputational and operational damage.

Immediate Action: Update the RTMKit plugin to the latest available version beyond 1.6.5 immediately.

Proactive Monitoring: Review web server logs for suspicious file uploads or access to unexpected file types in the uploads directory.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block unauthorized file upload attempts and restrict access to common upload endpoints.

Public Exploit Available: Unknown

The severity of this flaw necessitates an immediate update. If an update is not immediately available, the plugin should be disabled or removed from production environments until a secure version is deployed to mitigate the risk of remote code execution.