The WPMasterToolKit All in one plugin suffers a directory traversal flaw that allows an authenticated user with Administrator or higher privileges to read any file on the server and to overwrite arbitrary files. This grants an attacker full confidentiality and integrity compromise, enabling extraction of credentials, configuration data, or execution of arbitrary code by modifying core files. The weakness is identified as CWE‑22.

Affected systems are installations of the WPMMasterToolKit All in one plugin created by ludwigyou, in any version up to and including 2.5.2. No other products or versions are listed as impacted.

The plugin’s CVSS score of 7.2 categorizes the flaw as high severity, and the EPSS of 1% indicates a low but non-zero likelihood of exploitation under current conditions. It is not yet in the CISA KEV catalog. Since the vulnerability requires administrator-level authentication, the attacker must first gain legitimate access through WordPress credentials; once in, the flaw can be triggered via the plugin’s front‑end or back‑end interface, allowing file read and write operations without additional network vectors.