CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management – Education & Learning Management allows SQL Injection.This issue affects The School Management – Education & Learning Management: from n/a through 4.1.
Explanation of Vulnerability in Simple Terms
The School Management plugin for WordPress contains a SQL injection vulnerability in versions up to 4.1. An attacker with high-level site privileges can inject malicious SQL code to read or modify database contents. The vulnerability requires administrative access to exploit, limiting its risk to compromised admin accounts or insider threats.
What an attacker can do
Read or modify database records by injecting SQL code through the plugin.
Potential impact on your site
A compromised admin account could be used to steal sensitive data or corrupt your school database.
Conditions required to exploit
Attacker must have high-level WordPress privileges (administrator or equivalent role).
Key dates
External resources
Related vulnerabilities
