Local File Inclusion Vulnerability in School Management System Plugin by WordPress

CVE-2025-3740

What is CVE-2025-3740?

The School Management System plugin for WordPress contains a Local File Inclusion vulnerability that impacts all versions up to 93.1.0. Authenticated attackers with Subscriber-level access or higher can exploit the 'page' parameter to include and execute arbitrary files on the server. This vulnerability allows for the execution of any PHP code within those files, potentially leading to unauthorized access to sensitive data or privilege escalation. Attackers may leverage this flaw to include various dashboard view files from the plugin, which could facilitate actions like updating Super Administrator passwords in Multisite setups. The vendor has addressed this issue in versions starting with 1.93.1, released on February 7, 2025.

References