Wpmastertoolkit
Monthly
SQL injection in the WordPress plugin WPMasterToolKit affects versions 2.22.0 and earlier, allowing an attacker who already holds a WordPress Administrator session to inject arbitrary SQL through affected plugin functionality and read data from the underlying database. Exploitation requires the highest standard WordPress privilege level (PR:H per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and the assessed impact is confidentiality-only - no integrity or availability effect was confirmed - while the vulnerability has no public exploit identified at time of analysis and is not listed as confirmed actively exploited (CISA KEV). Because the required Administrator role already has broad legitimate database and site access in WordPress, this is best characterized as a high-CVSS-but-low-real-priority finding whose practical value is largely limited to insider abuse or post-compromise escalation, with no vendor-released fixed version identified at time of analysis.
SQL injection in the WordPress plugin WPMasterToolKit affects versions 2.22.0 and earlier, allowing an attacker who already holds a WordPress Administrator session to inject arbitrary SQL through affected plugin functionality and read data from the underlying database. Exploitation requires the highest standard WordPress privilege level (PR:H per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and the assessed impact is confidentiality-only - no integrity or availability effect was confirmed - while the vulnerability has no public exploit identified at time of analysis and is not listed as confirmed actively exploited (CISA KEV). Because the required Administrator role already has broad legitimate database and site access in WordPress, this is best characterized as a high-CVSS-but-low-real-priority finding whose practical value is largely limited to insider abuse or post-compromise escalation, with no vendor-released fixed version identified at time of analysis.