{
    "id": 5246,
    "date": "2025-12-10T08:33:22",
    "date_gmt": "2025-12-10T07:33:22",
    "guid": {
        "rendered": "https:\/\/wpmastertoolkit.com\/?p=5246"
    },
    "modified": "2026-09-22T19:35:10",
    "modified_gmt": "2026-09-22T17:35:10",
    "slug": "mise-a-jour-de-securite-cve-2025-14166-wpmastertoolkit-2-13-1",
    "status": "publish",
    "type": "post",
    "link": "https:\/\/wpmastertoolkit.com\/fr\/mise-a-jour-de-securite-cve-2025-14166-wpmastertoolkit-2-13-1\/",
    "title": {
        "rendered": "Mise \u00e0 jour de s\u00e9curit\u00e9 (CVE-2025-14166) : WPMasterToolKit 2.13.1"
    },
    "content": {
        "rendered": "<p class=\"wp-block-paragraph\">Suite \u00e0 un signalement du <strong>WordPress Plugins Team<\/strong> et des chercheurs de <strong>Wordfence<\/strong> (CVE-2025-14166), une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans le module <strong>Code Snippets<\/strong> de WPMasterToolKit (versions \u2264 2.13.0).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ce module permettait aux utilisateurs avec un r\u00f4le <strong>Contributor<\/strong> (et sup\u00e9rieur) d\u2019ajouter et d\u2019ex\u00e9cuter du code PHP, menant potentiellement \u00e0 une \u00e9l\u00e9vation de privil\u00e8ges.<br>\u26a0\ufe0f Cela pouvait \u00eatre exploit\u00e9 <strong>uniquement si<\/strong> le module Code Snippets avait \u00e9t\u00e9 activ\u00e9 au pr\u00e9alable par un administrateur et qu&rsquo;il avait d\u00e9j\u00e0 un acc\u00e8s <strong>Contributor<\/strong> ou sup\u00e9rieur.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u2714\ufe0f Correctif apport\u00e9 dans la version 2.13.1<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pour \u00e9liminer tout risque :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>L\u2019acc\u00e8s au module Code Snippets est d\u00e9sormais strictement r\u00e9serv\u00e9 aux Administrateurs<\/strong><\/li>\n\n\n\n<li>Les capacit\u00e9s WordPress ont \u00e9t\u00e9 revues afin de <strong>forcer la permission <code>manage_options<\/code><\/strong> sur toutes les actions li\u00e9es aux snippets<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Modification impl\u00e9ment\u00e9e :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"php\" class=\"language-php\">'capability_type'       =&gt; 'page',\n'capabilities'          =&gt; array(\n    'edit_post'          =&gt; 'manage_options',\n    'read_post'          =&gt; 'manage_options',\n    'delete_post'        =&gt; 'manage_options',\n    'edit_posts'         =&gt; 'manage_options',\n    'edit_others_posts'  =&gt; 'manage_options',\n    'publish_posts'      =&gt; 'manage_options',\n    'read_private_posts' =&gt; 'manage_options',\n),\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udd0e V\u00e9rifications compl\u00e9mentaires en cours<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Conform\u00e9ment aux exigences de WordPress.org :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Un audit complet des permissions est en cours sur l\u2019ensemble des modules<\/li>\n\n\n\n<li>Notre code subira un <strong>Plugin Check<\/strong> complet afin d\u2019assurer une conformit\u00e9 maximale aux normes de s\u00e9curit\u00e9 et de d\u00e9veloppement WordPress<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udee1\ufe0f Ce que vous devez faire<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Si vous utilisez WPMasterToolKit :<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2714\ufe0f Mettez votre plugin \u00e0 jour en <strong>2.13.1 ou sup\u00e9rieur<\/strong><br>\u26a0\ufe0f Si le module Code Snippets \u00e9tait activ\u00e9, v\u00e9rifiez qu\u2019aucun snippet suspect n\u2019a \u00e9t\u00e9 ajout\u00e9 par un utilisateur non-administrateur.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\ude4f Merci \u00e0 la communaut\u00e9 de s\u00e9curit\u00e9<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nous tenons \u00e0 remercier :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Les \u00e9quipes de WordPress.org Plugins Team<\/li>\n\n\n\n<li>Les chercheurs de Wordfence ayant identifi\u00e9 et document\u00e9 la faille<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Notre priorit\u00e9 est et restera la <strong>s\u00e9curit\u00e9<\/strong> des sites WordPress utilisant WPMasterToolKit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud83d\udc4b Une question, un doute, un signalement s\u00e9curit\u00e9 ?<br>Notre \u00e9quipe reste disponible via le support WordPress.org ou notre site officiel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Restons vigilants, restons s\u00e9curis\u00e9s. \ud83d\udd12\ud83d\ude80<\/p>",
        "protected": false
    },
    "excerpt": {
        "rendered": "<p>D\u00e9couvrez la mise \u00e0 jour de s\u00e9curit\u00e9 WPMasterToolKit 2.13.1, publi\u00e9e pour corriger la vuln\u00e9rabilit\u00e9 CVE-2025-14166. Cette version apporte un correctif essentiel afin de renforcer la protection des sites WordPress concern\u00e9s. Il est recommand\u00e9 de mettre \u00e0 jour le plugin pour b\u00e9n\u00e9ficier des derni\u00e8res am\u00e9liorations de s\u00e9curit\u00e9 et de fiabilit\u00e9.<\/p>",
        "protected": false
    },
    "author": 1,
    "featured_media": 0,
    "comment_status": "closed",
    "ping_status": "closed",
    "sticky": false,
    "template": "",
    "format": "standard",
    "meta": {
        "_acf_changed": false,
        "_seopress_titles_title": "WPMasterToolKit : corrigez la faille Code Snippets",
        "_seopress_titles_desc": "Mettez \u00e0 jour WPMasterToolKit en 2.13.1 pour corriger une vuln\u00e9rabilit\u00e9 du module Code Snippets et s\u00e9curiser votre site WordPress.",
        "_seopress_robots_index": "",
        "_seopress_robots_follow": "",
        "_seopress_robots_imageindex": "",
        "_seopress_robots_snippet": "",
        "_seopress_robots_primary_cat": "",
        "_seopress_robots_breadcrumbs": "",
        "_seopress_robots_freeze_modified_date": "",
        "_seopress_robots_custom_modified_date": "",
        "_seopress_robots_canonical": "",
        "_seopress_social_fb_title": "",
        "_seopress_social_fb_desc": "",
        "_seopress_social_fb_img": "",
        "_seopress_social_fb_img_attachment_id": 0,
        "_seopress_social_fb_img_width": 0,
        "_seopress_social_fb_img_height": 0,
        "_seopress_social_twitter_title": "",
        "_seopress_social_twitter_desc": "",
        "_seopress_social_twitter_img": "",
        "_seopress_social_twitter_img_attachment_id": 0,
        "_seopress_social_twitter_img_width": 0,
        "_seopress_social_twitter_img_height": 0,
        "_seopress_redirections_value": "",
        "_seopress_redirections_enabled": "",
        "_seopress_redirections_enabled_regex": "",
        "_seopress_redirections_logged_status": "",
        "_seopress_redirections_param": "",
        "_seopress_redirections_type": 0,
        "_seopress_analysis_target_kw": "",
        "_seopress_news_disabled": "",
        "_seopress_video_disabled": "",
        "_seopress_video": [],
        "_seopress_pro_schemas_manual": [],
        "_seopress_pro_rich_snippets_disable_all": "",
        "_seopress_pro_rich_snippets_disable": [],
        "_seopress_pro_schemas": [],
        "_surecart_dashboard_logo_width": "180px",
        "_surecart_dashboard_show_logo": true,
        "_surecart_dashboard_navigation_orders": true,
        "_surecart_dashboard_navigation_invoices": true,
        "_surecart_dashboard_navigation_subscriptions": true,
        "_surecart_dashboard_navigation_downloads": true,
        "_surecart_dashboard_navigation_billing": true,
        "_surecart_dashboard_navigation_account": true,
        "footnotes": ""
    },
    "categories": [
        1
    ],
    "tags": [],
    "class_list": [
        "post-5246",
        "post",
        "type-post",
        "status-publish",
        "format-standard",
        "hentry",
        "category-non-classe"
    ],
    "acf": [],
    "_links": {
        "self": [
            {
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/posts\/5246",
                "targetHints": {
                    "allow": [
                        "GET"
                    ]
                }
            }
        ],
        "collection": [
            {
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/posts"
            }
        ],
        "about": [
            {
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/types\/post"
            }
        ],
        "author": [
            {
                "embeddable": true,
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/users\/1"
            }
        ],
        "replies": [
            {
                "embeddable": true,
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/comments?post=5246"
            }
        ],
        "version-history": [
            {
                "count": 1,
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/posts\/5246\/revisions"
            }
        ],
        "predecessor-version": [
            {
                "id": 6667,
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/posts\/5246\/revisions\/6667"
            }
        ],
        "wp:attachment": [
            {
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/media?parent=5246"
            }
        ],
        "wp:term": [
            {
                "taxonomy": "category",
                "embeddable": true,
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/categories?post=5246"
            },
            {
                "taxonomy": "post_tag",
                "embeddable": true,
                "href": "https:\/\/wpmastertoolkit.com\/fr\/wp-json\/wp\/v2\/tags?post=5246"
            }
        ],
        "curies": [
            {
                "name": "wp",
                "href": "https:\/\/api.w.org\/{rel}",
                "templated": true
            }
        ]
    }
}