What the vulnerability does
01Description
The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server, leading to remote code execution, privilege escalation, and complete site compromise.
Explanation of Vulnerability in Simple Terms
02Summary
WPMasterToolKit versions up to 2.13.0 contain a code injection vulnerability that allows unauthenticated attackers to modify site content without user interaction. The plugin fails to properly validate or sanitize input before processing it, enabling attackers to inject malicious code. Site administrators should update to a version newer than 2.13.0 immediately.
What an attacker can do
03Attacker Capabilities
Inject and execute code to modify site content or functionality without authentication.
Potential impact on your site
04Site Impact
Site content can be altered or defaced by remote attackers without warning or user action.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
