CVE-2025-15655

HighCVSS 7.6

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The School Management plugin for WordPress versions up to 93.2.0 is vulnerable to SQL injection, allowing SQL query injection.

Risk Assessment

An attacker can steal or modify database data, including user data and passwords.

Recommendation

Update the School Management plugin to the latest version.

Other vulnerabilities in School Management

See all

CVE-2025-15657Medium
In School Management versions <= 93.1.0, there is a vulnerability of unauthenticated insecure direct object references (IDOR). This allows attackers to access data they should not have access to.
CVE-2025-15656High
The School Management plugin for WordPress versions up to 93.2.0 has an incorrect privilege assignment vulnerability allowing privilege escalation.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.