The School Management < 9.9.7 - Unauthenticated RCE via REST api

CVE-2022-1609

Summary

The School Management WordPress plugin, prior to version 9.9.7, is susceptible to a security vulnerability involving an obfuscated backdoor within its license checking mechanism. This backdoor registers a REST API handler that potentially allows an unauthorized attacker to execute arbitrary PHP code on affected websites. The exposure through this backdoor increases the risk of exploitation on WordPress installations utilizing this plugin, making it imperative for site administrators to update to the latest version to mitigate this security concern.

References