CVE-2025-15656
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The School Management plugin for WordPress versions up to 93.2.0 has an incorrect privilege assignment vulnerability allowing privilege escalation.
Risk Assessment
An attacker can gain higher privileges, enabling data modification, user creation, or site takeover.
Recommendation
Update the School Management plugin to the latest version.
Other vulnerabilities in School Management
See all- CVE-2025-15657Medium
In School Management versions <= 93.1.0, there is a vulnerability of unauthenticated insecure direct object references (IDOR). This allows attackers to access data they should not have access to.
- CVE-2025-15655High
The School Management plugin for WordPress versions up to 93.2.0 is vulnerable to SQL injection, allowing SQL query injection.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.