Data Loss Vulnerability in School Management System Plugin for WordPress by CodeCanyon
CVE-2024-12610
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 March 2025
What is CVE-2024-12610?
The School Management System for WordPress plugin is susceptible to unauthorized data deletion due to a missing capability check on crucial AJAX actions, namely 'mj_smgt_remove_feetype' and 'mj_smgt_remove_category_new'. This vulnerability permits unauthenticated attackers to delete any posts within the system, potentially leading to significant data loss and disruption. All versions up to and including 93.0.0 are affected, which poses a serious risk to website administrators and users relying on this plugin for managing school-related information.
Affected Version(s)
School Management System for Wordpress * <= 93.0.0