CVE-2026-66624

The WordPress plugin WPMasterToolKit in versions up to 2.22.0 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

Despite the required administrator privileges, exploitation can lead to leakage or modification of data in the WordPress database. In environments with multiple administrators or after admin account compromise, the risk is significant.

Update the WPMasterToolKit plugin to a version newer than 2.22.0. Limit the number of accounts with administrator privileges and regularly audit administrative activity.