CVE-2025-3300

Summary

CVE-2025-3300 is a critical vulnerability affecting the WPMasterToolKit (WPMTK) plugin for WordPress. This all-in-one plugin, used by administrators for various site management tasks, is susceptible to a Directory Traversal issue. The flaw enables authenticated attackers, who have Administrator-level access or higher, to read and manipulate arbitrary files on the server. The sensitive data contained in these files could potentially be exposed or modified, posing a significant security risk. Users of WPMTK plugin versions up to and including 2.5.2 are advised to update immediately to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.