Vulnerability · Published Dec 12, 2025 · Assigned by Wordfence

CVE-2025-14166WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection

Medium 5.3

In plain English

A medium-severity code injection in WPMasterToolKit (WPMTK) – All in one plugin from ludwigyou. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server, leading to remote code execution, privilege escalation, and complete site compromise.

Affected products (as reported)

Vendor	Product	Versions
ludwigyou	WPMasterToolKit (WPMTK) – All in one plugin	0 – through 2.13.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References