Privilege Escalation Vulnerability Affects School Management System

CVE-2024-9637

Summary

The WPSchoolPress plugin for WordPress is susceptible to a vulnerability that facilitates privilege escalation through account takeover, affecting all versions up to and including 2.2.10. This vulnerability stems from the plugin's failure to correctly validate user identities when changing account details, such as email addresses. As a result, authenticated attackers with teacher-level access or higher can exploit this flaw to alter any user's email address, including those of administrators. This action can lead to a reset of the user's password, granting the attacker unauthorized access to the compromised account, thereby compromising the integrity and security of the system.

References