Arbitrary File Upload Vulnerability in School Management System Plugin for WordPress
CVE-2025-6079

8.8HIGH

Key Information:

Vendor

WordPress
Status
School Management System For WordPress
Vendor
CVE Published:
16 August 2025

What is CVE-2025-6079?

The School Management System for WordPress contains a vulnerability that permits authenticated users, with Student-level access or higher, to bypass file type validation in the homework.php file. This flaw enables these users to upload arbitrary files onto the server, potentially leading to unauthorized remote code execution. Site administrators are advised to review and patch their installations to prevent exploitation.

Affected Version(s)

School Management System for Wordpress * <= 93.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/school-management-system-for-...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Friderika Baranyai
JSON
.