CVE-2025-14166

MediumCVSS 5.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to and including 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. Authenticated attackers with Contributor-level access and above can execute arbitrary PHP code on the server, leading to remote code execution, privilege escalation, and complete site compromise.

Risk Assessment

An attacker with low privileges can execute arbitrary PHP code on the server, leading to complete site compromise, privilege escalation, and potential access to other systems.

Recommendation

Upgrade the WPMasterToolKit plugin to a version later than 2.13.0, which contains a fix for this issue.

Other vulnerabilities in WPMasterToolKit

CVE-2026-66624High
The WordPress plugin WPMasterToolKit in versions up to 2.22.0 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

Original NVD description (English source)

The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server, leading to remote code execution, privilege escalation, and complete site compromise.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS