Data Loss Vulnerability in School Management System Plugin for WordPress by CodeCanyon

CVE-2024-12610

What is CVE-2024-12610?

The School Management System for WordPress plugin is susceptible to unauthorized data deletion due to a missing capability check on crucial AJAX actions, namely 'mj_smgt_remove_feetype' and 'mj_smgt_remove_category_new'. This vulnerability permits unauthenticated attackers to delete any posts within the system, potentially leading to significant data loss and disruption. All versions up to and including 93.0.0 are affected, which poses a serious risk to website administrators and users relying on this plugin for managing school-related information.

References