WordPress plugin
WPMasterToolKit (WPMTK) – All in one plugin security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium4
- Low0
All WPMasterToolKit (WPMTK) – All in one plugin vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.9 | Authenticated (Administrator+) SQL Injection ≤2.22.0Update to 2.23.1 | CVE-2026-66624 | |
| Medium4.3 | Missing Authorization ≤2.14.0Update to 2.14.1 | CVE-2026-24388 | |
| Medium5.3 | Authenticated (Contributor+) Code Injection ≤2.13.0Update to 2.13.1 | CVE-2025-14166 | |
| High7.2 | Authenticated (Administrator+) to Arbitrary File Read and Write ≤1.15.0Update to 2.6.0 | CVE-2025-3300 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload ≤1.13.1Update to 1.14.0 | CVE-2024-56249 | |
| Medium4.9 | Authenticated (Admin+) Arbitrary File Download ≤1.13.1Update to 1.14.0 | CVE-2024-56248 |
- Medium4.9Authenticated (Administrator+) SQL Injection
≤2.22.0Update to 2.23.1
- Medium4.3Missing Authorization
≤2.14.0Update to 2.14.1
- Medium5.3Authenticated (Contributor+) Code Injection
≤2.13.0Update to 2.13.1
- High7.2Authenticated (Administrator+) to Arbitrary File Read and Write
≤1.15.0Update to 2.6.0
- High7.2Authenticated (Admin+) Arbitrary File Upload
≤1.13.1Update to 1.14.0
- Medium4.9Authenticated (Admin+) Arbitrary File Download
≤1.13.1Update to 1.14.0
WPMasterToolKit (WPMTK) – All in one plugin: common questions
Does WPMasterToolKit (WPMTK) – All in one plugin have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in WPMasterToolKit (WPMTK) – All in one plugin: 2 high, 4 medium. None are known to affect version null.
How do I check which version of WPMasterToolKit (WPMTK) – All in one plugin I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPMasterToolKit (WPMTK) – All in one plugin vulnerability?
CVE-2026-66624, published Sep 17, 2026: WPMasterToolKit (WPMTK) – All in one plugin <= 2.22.0 - Authenticated (Administrator+) SQL Injection. Severity: Medium (CVSS 4.9).
Is any WPMasterToolKit (WPMTK) – All in one plugin vulnerability listed in CISA KEV?
No. None of the known WPMasterToolKit (WPMTK) – All in one plugin vulnerabilities is currently listed in the CISA KEV catalog.