Arbitrary File Upload Vulnerability in School Management System Plugin for WordPress
CVE-2025-6079
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 August 2025
What is CVE-2025-6079?
The School Management System for WordPress contains a vulnerability that permits authenticated users, with Student-level access or higher, to bypass file type validation in the homework.php file. This flaw enables these users to upload arbitrary files onto the server, potentially leading to unauthorized remote code execution. Site administrators are advised to review and patch their installations to prevent exploitation.
Affected Version(s)
School Management System for Wordpress * <= 93.2.0