{"id":5246,"date":"2025-12-10T08:33:22","date_gmt":"2025-12-10T07:33:22","guid":{"rendered":"https:\/\/wpmastertoolkit.com\/?p=5246"},"modified":"2026-09-22T19:35:10","modified_gmt":"2026-09-22T17:35:10","slug":"mise-a-jour-de-securite-cve-2025-14166-wpmastertoolkit-2-13-1","status":"publish","type":"post","link":"https:\/\/wpmastertoolkit.com\/es\/actualizacion-de-seguridad-cve-2025-14166-wpmastertoolkit-2-13-1\/","title":{"rendered":"Actualizaci\u00f3n de seguridad (CVE-2025-14166): WPMasterToolKit 2.13.1"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Tras un informe de <strong>Equipo de plugins de WordPress<\/strong> e investigadores de <strong>Wordfence<\/strong> (CVE-2025-14166), se ha identificado una vulnerabilidad en el <strong>Fragmentos de c\u00f3digo<\/strong> de WPMasterToolKit (versiones \u2264 2.13.0).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Este m\u00f3dulo permit\u00eda a los usuarios con <strong>Colaborador<\/strong> (y superiores) para a\u00f1adir y ejecutar c\u00f3digo PHP, lo que podr\u00eda conducir a una elevaci\u00f3n de privilegios.<br>\u26a0\ufe0f Esto podr\u00eda ser explotado <strong>s\u00f3lo si<\/strong> el m\u00f3dulo Code Snippets hab\u00eda sido activado previamente por un administrador y ya ten\u00eda acceso <strong>Colaborador<\/strong> o superior.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u2714\ufe0f Corregido en la versi\u00f3n 2.13.1<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Para eliminar cualquier riesgo :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>El acceso al m\u00f3dulo Fragmentos de c\u00f3digo est\u00e1 ahora estrictamente reservado a los administradores.<\/strong><\/li>\n\n\n\n<li>Las funciones de WordPress se han revisado para <strong>forzar permiso <code data-no-auto-translation=\"\">manage_options<\/code><\/strong> en todas las acciones relacionadas con fragmentos<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Modificaci\u00f3n aplicada :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"php\" class=\"language-php\" data-no-auto-translation=\"\">'capability_type'       =&gt; 'page',\n'capabilities'          =&gt; array(\n    'edit_post'          =&gt; 'manage_options',\n    'read_post'          =&gt; 'manage_options',\n    'delete_post'        =&gt; 'manage_options',\n    'edit_posts'         =&gt; 'manage_options',\n    'edit_others_posts'  =&gt; 'manage_options',\n    'publish_posts'      =&gt; 'manage_options',\n    'read_private_posts' =&gt; 'manage_options',\n),\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd0e Controles adicionales en curso<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">De acuerdo con los requisitos de WordPress.org :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Se est\u00e1 realizando una auditor\u00eda completa de los permisos de todos los m\u00f3dulos<\/li>\n\n\n\n<li>Nuestro c\u00f3digo se someter\u00e1 a un <strong>Comprobaci\u00f3n de plugins<\/strong> para garantizar el m\u00e1ximo cumplimiento de las normas de desarrollo y seguridad de WordPress<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee1\ufe0f Lo que hay que hacer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Si utiliza WPMasterToolKit :<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2714\ufe0f Actualice su plugin mediante <strong>2.13.1 o superior<\/strong><br>\u26a0\ufe0f Si se ha activado el m\u00f3dulo Fragmentos de c\u00f3digo, compruebe que ning\u00fan usuario no administrador haya a\u00f1adido fragmentos sospechosos.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\ude4f Gracias a la comunidad de seguridad<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Queremos dar las gracias a :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>El equipo de plugins de WordPress.org<\/li>\n\n\n\n<li>Los investigadores de Wordfence que identificaron y documentaron el fallo<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Nuestra prioridad es y seguir\u00e1 siendo <strong>seguridad<\/strong> Sitios WordPress utilizando WPMasterToolKit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud83d\udc4b \u00bfUna pregunta, una duda, una alerta de seguridad?<br>Nuestro equipo sigue disponible a trav\u00e9s del soporte de WordPress.org o de nuestro sitio web oficial.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Manteng\u00e1monos alerta, manteng\u00e1monos a salvo. \ud83d\udd12\ud83d\ude80<\/p>","protected":false},"excerpt":{"rendered":"<p>Descubre la actualizaci\u00f3n de seguridad de WPMasterToolKit 2.13.1, publicada para corregir la vulnerabilidad CVE-2025-14166. Esta versi\u00f3n incluye una correcci\u00f3n esencial para reforzar la protecci\u00f3n de los sitios de WordPress afectados. Se recomienda actualizar el plugin para beneficiarse de las \u00faltimas mejoras en seguridad y fiabilidad.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_seopress_titles_title":"WPMasterToolKit : corrigez la faille Code Snippets","_seopress_titles_desc":"Mettez \u00e0 jour WPMasterToolKit en 2.13.1 pour corriger une vuln\u00e9rabilit\u00e9 du module Code Snippets et s\u00e9curiser votre site WordPress.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"_surecart_dashboard_logo_width":"180px","_surecart_dashboard_show_logo":true,"_surecart_dashboard_navigation_orders":true,"_surecart_dashboard_navigation_invoices":true,"_surecart_dashboard_navigation_subscriptions":true,"_surecart_dashboard_navigation_downloads":true,"_surecart_dashboard_navigation_billing":true,"_surecart_dashboard_navigation_account":true,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-5246","post","type-post","status-publish","format-standard","hentry","category-non-classe"],"acf":[],"_links":{"self":[{"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/posts\/5246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/comments?post=5246"}],"version-history":[{"count":1,"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/posts\/5246\/revisions"}],"predecessor-version":[{"id":6667,"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/posts\/5246\/revisions\/6667"}],"wp:attachment":[{"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/media?parent=5246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/categories?post=5246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpmastertoolkit.com\/es\/wp-json\/wp\/v2\/tags?post=5246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}