PT-2025-50863 · WordPress · Wpmastertoolkit

Athiwat Tiprasaharn + 6 · Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-14166

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPMasterToolKit plugin for WordPress versions prior to 2.13.1

Description The WPMasterToolKit plugin for WordPress allows authenticated attackers with Contributor-level access or above to execute arbitrary PHP code on the server. This is possible because the plugin permits Author-level users to create and execute PHP code through the Code Snippets feature without sufficient capability checks. Successful exploitation can lead to remote code execution, privilege escalation, and complete site compromise.

Recommendations Update the WPMasterToolKit plugin to version 2.13.1 or later.

Fix

LPE

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-14166

Affected Products

Wpmastertoolkit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14166 · Security Note
• https://plugins.trac.wordpress.org/browser/wpmastertoolkit/tags/2.13.0/admin/modules/core/class-code-snippets.php#L135 · Note
• https://plugins.trac.wordpress.org/log/wpmastertoolkit · Note
• https://plugins.trac.wordpress.org/browser/wpmastertoolkit/trunk/admin/modules/core/class-code-snippets.php#L135 · Note
• https://t.me/CVEtracker/39562 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6049996a-514a-44f7-9878-4aa43598842a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wpmastertoolkit/tags/2.13.0/admin/modules/core/class-code-snippets.php#L628 · Note
• https://plugins.trac.wordpress.org/browser/wpmastertoolkit/trunk/admin/modules/core/class-code-snippets.php#L628 · Note