WordPress plugin · wpmastertoolkit

Is WPMasterToolKit (WPMTK) safe?

Safe on 2.25.0 or newer.

The current version, 2.25.0, is past every affected range on record (6 of 6 records list one). Keep it updated and you’re clear of them.

Flaws on record: 6
High or critical: 3
Exploited: none
Current version: 2.25.0
Last updated: Sep 24, 2026
Active installs: 5,000+

Every recorded flaw

Sep 17, 2026Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.CVE-2026-66624 · affects up to 2.22.0 · reported by PatchstackHigh 7.6
Jan 22, 2026WPMasterToolKit: Missing AuthorizationCVE-2026-24388 · affects up to 2.14.0 · reported by PatchstackMedium 4.3
Dec 11, 2025WPMasterToolKit: PHP Code InjectionCVE-2025-14166 · affects up to 2.13.0 · reported by WordfenceMedium 5.3
Apr 24, 2025WPMasterToolKit (WPMTK) – All in one: Directory TraversalCVE-2025-3300 · affects up to 2.5.2 · reported by WordfenceHigh 7.2
Jan 2, 2025WPMasterToolKit: Unrestricted Upload of File with Dangerous TypeCVE-2024-56249 · affects up to 1.13.1 · reported by Patchstack1.3% oddsCritical 9.1
Jan 2, 2025WPMasterToolKit: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-56248 · affects up to 1.13.1 · reported by PatchstackMedium 4.9

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Is WPMasterToolKit (WPMTK) safe?

Safe on 2.25.0 or newer.

Every recorded flaw

The flaws that hit local websites, every Friday.

Tell us what you're building.