CVE-2026-66624 is an SQL Injection vulnerability (CWE-89) in the WPMasterToolKit plugin by Ludwig You, affecting versions up to 2.22.0. The flaw arises from improper neutralization of special elements used in SQL commands, allowing an administrator-level user to inject malicious SQL code. The vulnerability has a CVSS 3.1 base score of 7.6, with network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. There is no information on available patches or vendor advisories at this time.

An attacker with administrator privileges can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. The vulnerability requires high privileges and no user interaction, limiting exploitation to trusted administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to SQL queries within the WPMasterToolKit plugin.