CVE-2025-14166

Name of the Vulnerable Software and Affected Versions WPMasterToolKit plugin for WordPress versions prior to 2.13.1

Description The WPMasterToolKit plugin for WordPress allows authenticated attackers with Contributor-level access or above to execute arbitrary PHP code on the server. This is possible because the plugin permits Author-level users to create and execute PHP code through the Code Snippets feature without sufficient capability checks. Successful exploitation can lead to remote code execution, privilege escalation, and complete site compromise.

Recommendations Update the WPMasterToolKit plugin to version 2.13.1 or later.