Privilege Escalation Vulnerability in School Management System Plugin by WordPress

CVE-2025-1667

What is CVE-2025-1667?

The WPSchoolPress plugin for WordPress suffers from a privilege escalation vulnerability due to a lack of capability checks on the wpsp_UpdateTeacher() function. Authenticated users with teacher-level access or greater can exploit this flaw to modify user details, including email addresses. This could enable them to initiate password resets, potentially compromising user accounts, including those of administrators. The issue affects all versions of the plugin up to and including version 2.2.16.

References