WPMasterToolKit CVE-2025-14166

Requires an authenticated WordPress account at Contributor level or above (Author-level is explicitly named) because the plugin's Code Snippets feature omits proper capability checks before creating and executing PHP. The specific prerequisite is access to the WPMasterToolKit Code Snippets feature on a site running version ≤ 2.13.0. Limiting factors: exploitation is NOT fully unauthenticated despite the provided vector's PR:N - a valid Contributor/Author session is mandatory, so sites that disable open registration or restrict author-level roles substantially reduce exposure; no user interaction from a victim and no special non-default configuration beyond having the plugin active are needed.

Signals conflict sharply and must be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) is internally inconsistent with the description: it claims PR:N (unauthenticated) and only I:L with C:N/A:N, yet the description states exploitation requires 'authenticated attackers, with Contributor-level access and above' and results in 'remote code execution, privilege escalation, and complete site compromise' - which is a full C/I/A high impact, not a single low-integrity impact. This discrepancy suggests the published 5.3 score materially understates true impact; an independent assessment lands near CVSS 8.8 (High). EPSS is low at 0.46% (38th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, so there is no evidence of active or imminent mass exploitation today. Net: this is a genuinely serious authenticated RCE (any Contributor/Author account converts to full server code execution) whose official 5.3 score is misleadingly low, but real-world urgency is tempered by the authentication prerequisite, modest EPSS, and absence of KEV/POC. Prioritize patching on sites that allow untrusted Contributor/Author registrations; treat as lower urgency where author-level accounts are tightly controlled.

An attacker who holds (or registers/obtains) a Contributor- or Author-level WordPress account logs in and navigates to the WPMasterToolKit Code Snippets feature, which fails to enforce proper capability checks. They create a snippet containing arbitrary PHP, which the plugin then executes on the server, yielding remote code execution, privilege escalation to administrator, and full site compromise. No public exploit was identified at time of analysis, and because PR is effectively low (not none), the attacker must first possess a low-privilege authenticated account.