Data Loss Vulnerability in School Management System Plugin for WordPress by CodeCanyon
CVE-2024-12610

5.3MEDIUM

Key Information:

Vendor
WordPress
Status
School Management System For WordPress
Vendor
CVE Published:
7 March 2025

Summary

The School Management System for WordPress plugin is susceptible to unauthorized data deletion due to a missing capability check on crucial AJAX actions, namely 'mj_smgt_remove_feetype' and 'mj_smgt_remove_category_new'. This vulnerability permits unauthenticated attackers to delete any posts within the system, potentially leading to significant data loss and disruption. All versions up to and including 93.0.0 are affected, which poses a serious risk to website administrators and users relying on this plugin for managing school-related information.

Affected Version(s)

School Management System for Wordpress * <= 93.0.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/school-management-system-for-...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.